Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2023-54357 | 8.7 high | 1.0% | artio, book_it\! | Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses through brute force enumeration. | 11 h ago |
| CVE-2026-112399 | 8.7 high | 1.0% | python, pillow | Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0. | 14 h ago |
| CVE-2026-112350 | 8.7 high | 1.0% | no CPE yet | Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise. | 16 h ago |
| CVE-2026-103603 | 8.7 high | 1.0% | bouncycastle, bc-csharp | Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker who can supply both an HSS public key and a signature to cause a denial of service through memory exhaustion via a public key encoding with an excessive level count, because the level count L read when parsing an HSS public key was not checked against the RFC 8554 maximum of 8, and signature parsing then allocated an array of L - 1 entries before reading any further signature data. A single verification can commit up to about 17 GB of memory or fail with an OutOfMemoryException. | 17 h ago |
| CVE-2026-116682 | 8.6 high | 1.0% | no CPE yet | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta. | 15 h ago |
| CVE-2026-117607 | 8.6 high | 1.0% | no CPE yet | Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server. | 15 h ago |
| CVE-2026-50340 | 8.5 high | 1.0% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Use after free in Windows Runtime allows an authorized attacker to elevate privileges over a network. | 11 h ago |
| CVE-2026-50528 | 8.2 high | 1.0% | microsoft, .net, visual_studio_2022, visual_studio_2026 | Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. | 10 h ago |
| CVE-2026-50429 | 8.2 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network. | 11 h ago |
| CVE-2026-112893 | 8.2 high | 1.0% | python, pillow | Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0. | 14 h ago |
| CVE-2026-112395 | 8.2 high | 1.0% | python, pillow | Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation. An attacker can supply a crafted tiled TIFF to an application that loads it. This can expose adjacent heap data in pixels or crash the process. This issue is fixed in version 13.0.0. | 14 h ago |
| CVE-2026-57191 | 8.2 high | 1.0% | no CPE yet | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `sscanf` in `res_pjsip_pubsub` when parsing the `MWI NOTIFY` `Message-Account` field may allow an unauthenticated attacker to send a carefully crafted packet that causes a stack buffer overflow and corrupts the underlying transport, permanently disabling all SIP functionality. An Asterisk restart is required to restore full operation. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. | 16 h ago |
| CVE-2023-3932 | 8.2 high | 1.0% | gitlab | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. | 19 h ago |
| CVE-2026-56186 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows Schannel allows an authorized attacker to disclose information over a network. | 11 h ago |
| CVE-2026-50686 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to execute code over a network. | 11 h ago |
| CVE-2026-50487 | 8.1 high | 1.0% | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Use after free in Microsoft Windows DNS allows an unauthorized attacker to elevate privileges over a network. | 11 h ago |
| CVE-2026-50439 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network. | 11 h ago |
| CVE-2026-50460 | 8.1 high | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network. | 11 h ago |
| CVE-2026-50694 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. | 11 h ago |
| CVE-2026-54995 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | 11 h ago |
| CVE-2026-49164 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. | 11 h ago |
| CVE-2026-42900 | 8.1 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate privileges over a network. | 11 h ago |
| CVE-2026-70229 | 8.1 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-88120 | 8.1 high | 1.0% | microsoft, windows_server_2012, windows_server_2016, windows_server_2019 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 14 h ago |
| CVE-2026-88117 | 8.1 high | 1.0% | microsoft, windows_server_2012, windows_server_2016, windows_server_2019 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 14 h ago |
| CVE-2026-88119 | 8.1 high | 1.0% | microsoft, windows_server_2012, windows_server_2016, windows_server_2019 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 14 h ago |
| CVE-2026-70062 | 8.1 high | 1.0% | microsoft, windows_10_1809, windows_10_21h2, windows_10_22h2 | Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network. | 14 h ago |
| CVE-2026-50683 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges over an adjacent network. | 11 h ago |
| CVE-2026-50502 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execute code over a network. | 11 h ago |
| CVE-2026-50365 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network. | 11 h ago |
| CVE-2026-49169 | 8.0 high | 1.0% | microsoft, windows server 2025, windows server 2025 (server core installation) | Use after free in DNS Server allows an authorized attacker to execute code over a network. | 11 h ago |
| CVE-2026-42975 | 8.0 high | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network. | 11 h ago |
| CVE-2026-50665 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | 11 h ago |
| CVE-2026-55130 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 11 h ago |
| CVE-2026-55128 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 11 h ago |
| CVE-2026-55134 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 11 h ago |
| CVE-2026-55132 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 11 h ago |
| CVE-2026-55038 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 11 h ago |
| CVE-2026-55055 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 11 h ago |
| CVE-2026-55127 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 11 h ago |
| CVE-2026-55033 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 11 h ago |
| CVE-2026-55032 | 7.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 11 h ago |
| CVE-2026-88133 | 7.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally. | 11 h ago |
| CVE-2026-85359 | 7.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally. | 13 h ago |
| CVE-2026-70131 | 7.8 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to elevate privileges locally. | 13 h ago |
| CVE-2026-57197 | 7.7 high | 1.0% | no CPE yet | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded `memcpy` of `OGG/Speex` packet data in `format_ogg_speex` can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio. The attacker must create the file and make it available to Asterisk either through sufficiently elevated privileges or by convincing an Asterisk administrator to make it available. Asterisk must also be configured to play that file. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. | 16 h ago |
| CVE-2026-62898 | 7.5 high | 1.0% | microsoft, visual_studio_2022, visual_studio_2026, .net | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. | 9 h ago |
| CVE-2026-62901 | 7.5 high | 1.0% | microsoft, visual_studio_2022, visual_studio_2026, .net | Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. | 10 h ago |
| CVE-2026-57108 | 7.5 high | 1.0% | microsoft, .net | Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network. | 10 h ago |
| CVE-2026-56170 | 7.5 high | 1.0% | microsoft, .net | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 10 h ago |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.