Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-62331 | 8.2 high | — | mtzanidakis, praktor | praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename into a destination path without sanitization, and `path.Join` collapses parent-directory traversal. A remote Telegram user who can message the bot can therefore write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`. Because `allow_from: []` permits all senders by default, no prior authentication or privilege is required in that configuration. The attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook, or configuration files that the Claude agent reads and operates on across later runs, turning a document upload into stored instruction injection. The demonstrated arbitrary-write scope is the persistent agent workspace volume, not an unrestricted host-filesystem write. This issue is fixed in version 0.9.1. | 23 h ago |
| CVE-2026-79884 | 8.2 high | 0.00% | no CPE yet | A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise. | 24 h ago |
| CVE-2026-61586 | 8.2 high | — | copernik-eu, copernik-xml-factory | Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or on an `XMLReader` passed through `XmlFactories.harden()`. An application parsing untrusted XML can resolve attacker-controlled `xi:include` references to disclose local files or, through `http` references, reach internal network endpoints by server-side request forgery. Exploitation requires use of one of those factory/hardening APIs, the stock JDK provider with Apache Xerces absent from the classpath, explicit `setXIncludeAware(true)` or the equivalent reader feature, and XML from an untrusted source. The Xerces provider selected when Xerces is present and the Android provider are unaffected. This issue is fixed in version 0.1.2. | Fri 30 Oct |
| CVE-2026-61854 | 8.2 high | — | jackh54, voicesentinel | VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1. | Fri 30 Oct |
| CVE-2024-5154 | 8.1 high | — | red hat, red hat openshift container platform 4.12, red hat openshift container platform 4.13, red hat openshift container platform 4.14 | A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system. | 6 h ago |
| CVE-2026-103898 | 8.1 high | — | roxnor, wp social login and register social counter | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` with `permission_callback => __return_true` locating an existing WordPress account solely by the email string returned from the OAuth provider and calling `wp_set_auth_cookie()` without a password check, while the only verification guard — `!empty($getProfile->emailVerified)` in `inc/admin-create-user.php` — is a no-op for the bundled Hybridauth Facebook and Twitter adapters, both of which assign the raw email string rather than a boolean verified flag to `emailVerified`. This makes it possible for unauthenticated attackers to obtain a fully authenticated session as any existing WordPress user, including Administrators, whose registered email address can be presented through a configured Facebook or Twitter login on the target site. Exploitation requires only that the attacker control an OAuth account whose provider-returned email matches the target account's registered WordPress email address; no local credentials, nonce, or prior foothold is needed. | 11 h ago |
| CVE-2026-119977 | 8.1 high | — | wordpress foundation, wordpress | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. | 13 h ago |
| CVE-2026-88097 | 8.1 high | 0.00% | microsoft, microsoft edge (chromium-based) | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-69680 | 8.1 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network. | 21 h ago |
| CVE-2026-63182 | 8.1 high | — | litesaml, lightsaml | LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. `Response::deserialize` uses `manyElementsFromXml` to collect only direct-child `saml:Assertion` elements of `samlp:Response`, and `AssertionSignatureValidatorAction` validates their `ds:Signature` using an out-of-band trusted IdP credential resolved by Issuer, not a key from the document. `XMLSecurityDSig::validateReference()` removes the enveloped signature from the shared DOM, but `processRefNode()` resolves `Reference URI="#id"` document-wide through an XPath of the form `//*[@Id]` and takes `item(0)`, which need not be the assertion whose claims LightSAML consumes. An attacker who has captured one genuinely signed assertion, such as an earlier login response, can place its signature-stripped bytes earlier in `samlp:Extensions` and present a forged direct-child assertion with the same ID and copied genuine signature. Validation then covers the hidden genuine bytes while LightSAML surfaces unsigned attacker-controlled `Subject/NameID`, `Conditions`, and `Attributes`, enabling authentication bypass or privilege escalation even when signature validation is required. The behavior was confirmed in versions 5.0.0 and 4.6.1. This issue is fixed in versions 4.7.1 and 5.0.1. | 21 h ago |
| CVE-2026-62989 | 8.1 high | — | shopperlabs, shopper | Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. An authenticated staff user with `edit_products` can access `/shopper/products/{id}/edit` and obtain the signed component state even without `delete_product_variants`. The `callTableAction` and `callTableBulkAction` paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0. | 22 h ago |
| CVE-2026-62967 | 8.1 high | — | sinamics, ztnet | ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an administrator, through `POST /api/auth/user/invalidateUser`. In `src/pages/api/auth/user/invalidateUser.ts`, `getServerSession` checks only that a session exists and does not compare `session.user.id` with the client-supplied `userId`. Supplying a victim's `userId` and a `deviceId` for which no matching pair exists in `UserDevice` makes the handler set the target account's `isActive` to false. Login is then refused by `src/server/auth.ts` with `account-expired`. An attacker needs only a normal authenticated account and the victim's user ID, which may be obtainable from member lists, UI responses, logs, or other application metadata. This can lock administrators out, disrupt organization management, and deny access to any targeted user. This issue is fixed in version 0.8.0. | 22 h ago |
| CVE-2026-117681 | 8.0 high | — | no CPE yet | A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster. | 10 h ago |
| CVE-2026-119250 | 7.8 high | 0.00% | ubiquiti inc, wifiman desktop | A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device. | 6 h ago |
| CVE-2026-119336 | 7.8 high | — | pi-hole | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5. | 21 h ago |
| CVE-2026-70125 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office ltsc 2021, microsoft office ltsc 2024 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-83498 | 7.8 high | 0.00% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-84000 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally. | 21 h ago |
| CVE-2026-83995 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83990 | 7.8 high | 0.00% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83985 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83983 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83987 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83980 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83982 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83978 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83977 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83981 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83973 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83968 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83972 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83970 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83967 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83954 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-83971 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-72965 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally. | 21 h ago |
| CVE-2026-81948 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81950 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81949 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81953 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81959 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81951 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81388 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81957 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81960 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81956 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81397 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81396 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81954 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
| CVE-2026-81947 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 h ago |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.