Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-111497KEVexploit ×68news ×13 | 9.2 critical | 88.0% | google, nodejs, brotli, node.js, brotlicffi | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. | 14 h ago |
| CVE-2026-48356KEVexploit ×2 | 9.3 critical | 59.0% | adobe, commerce, commerce_b2b, magento | Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. | 18 h ago |
| CVE-2026-46300KEVexploit ×17 | 7.8 high | 10.0% | linux, linux_kernel | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors. | 11 h ago |
| CVE-2026-104286KEVexploit ×5 | 9.8 critical | 5.0% | fortinet, fortimail | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. | 11 h ago |
| CVE-2026-55040exploit ×5 | 9.1 critical | 70.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. | 11 h ago |
| CVE-2024-45257exploit | 7.3 high | 4.0% | no CPE yet | A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on the server via a crafted build parameter. This occurs in freeze in core/generators.py. | 22 h ago |
| CVE-2024-46507exploit | 7.3 high | 4.0% | yeti-platform, yeti | A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server. | 22 h ago |
| CVE-2026-50522exploit ×5 | 9.8 critical | 3.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | 11 h ago |
| CVE-2023-0902exploit ×2 | 5.4 medium | 3.0% | simple_food_ordering_system_project, simple_food_ordering_system | A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451. | 12 h ago |
| CVE-2023-52356exploit | 7.5 high | 2.0% | debian, apple, debian_linux, ipados, iphone_os | A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service. | 12 h ago |
| CVE-2026-56190exploit ×2 | 9.8 critical | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network. | 11 h ago |
| CVE-2026-116692exploit | 9.8 critical | 1.0% | no CPE yet | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.model_validate_json() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0. | 16 h ago |
| CVE-2026-114509exploit ×7 | 9.2 critical | 1.0% | no CPE yet | Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0. | 13 h ago |
| CVE-2026-54121exploit ×15 | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network. | 11 h ago |
| CVE-2026-50369exploit | 8.8 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network. | 11 h ago |
| CVE-2026-47301exploit | 8.8 high | 1.0% | microsoft, microsoft configuration manager, microsoft configuration manager 2509, microsoft configuration manager 2603 | Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. | 11 h ago |
| CVE-2026-69414exploit ×2 | 7.8 high | 1.0% | microsoft, malware_protection_engine | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ". | 11 h ago |
| CVE-2024-27686exploit | 7.5 high | 1.0% | no CPE yet | Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the SMB service on TCP port 445. | 22 h ago |
| CVE-2026-34348exploit | 6.5 medium | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network. | 11 h ago |
| CVE-2024-30167exploit ×2 | 6.3 medium | 1.0% | no CPE yet | /cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a POST request that carries a serverName parameter. | 22 h ago |
| CVE-2023-32070exploit | 6.1 medium | 1.0% | xwiki, rendering | XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version. | 12 h ago |
| CVE-2026-56164exploit ×2 | 5.3 medium | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | 11 h ago |
| CVE-2023-47268exploit ×2 | 5.3 medium | 1.0% | prusa3d, prusaslicer | In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported. | 12 h ago |
| CVE-2026-54107exploit | 8.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally. | 11 h ago |
| CVE-2023-49440exploit | 8.8 high | 0.00% | no CPE yet | AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter." | 12 h ago |
| CVE-2026-74580exploit ×4 | 8.8 high | 0.00% | no CPE yet | In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cache hit, taking the hit as proof that the region has already been validated: if (vhost_vq_meta_fetch(vq, addr, len, type)) return true; The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on device IOTLB (re)initialisation and on vq reset, but not when VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when VHOST_SET_VRING_NUM changes the region sizes. With a device IOTLB attached both ioctls are accepted while the vq is live, and neither validates the addresses at ioctl time: vq_access_ok() and vq_log_used_access_ok() return true early because the addresses are GIOVAs, deferring validation to prefetch time. Once the cache has been populated that deferred validation no longer runs -- vq_meta_prefetch() hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps translating through the old mapping as map->addr + addr - map->start for an address the mapping no longer covers. vhost_copy_to_user() and vhost_copy_from_user() consume the result with __copy_to_user() and __copy_from_user(), which do not check it either, so a subsequent used ring update or descriptor fetch accesses memory outside the region the IOTLB actually maps. Reset the metadata cache whenever the vring is reconfigured, so the new addresses are pushed back through iotlb_access_ok()'s slow path. | 12 h ago |
| CVE-2026-54992exploit | 8.4 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally. | 11 h ago |
| CVE-2026-50402exploit | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally. | 11 h ago |
| CVE-2026-50343exploit | 7.8 high | 0.00% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally. | 11 h ago |
| CVE-2026-58635exploit | 7.8 high | 0.00% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally. | 11 h ago |
| CVE-2026-49176exploit ×2 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally. | 11 h ago |
| CVE-2026-114101exploit ×2 | 6.3 medium | 0.00% | no CPE yet | Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*. | 17 h ago |
| CVE-2024-33722exploit | 6.3 medium | 0.00% | no CPE yet | SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[]. | 22 h ago |
| CVE-2026-50416exploit ×2 | 3.3 low | 0.00% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. | 11 h ago |
| CVE-2026-116370exploit | 2.1 low | 0.00% | 2k, sid_meiers_civilization_vi | A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure. | 14 h ago |
35 of 35
Download these 35 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.