Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-62900 | 5.9 medium | 1.0% | microsoft, visual_studio_2022, visual_studio_2026, .net | Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network. | 19 h ago |
| CVE-2026-116778 | 8.8 high | — | no CPE yet | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API validates the credentials but does not enforce an administrator-only role. With storage replication enabled and a usable Storage Node, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing the low-privileged user to execute commands as root. This issue is fixed in versions 1.5.10.2253 and 1.6.0-RC-1. | 23 h ago |
| CVE-2026-118755 | 8.6 high | — | no CPE yet | Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user. | 18 h ago |
| CVE-2026-87706 | 7.8 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | 19 h ago |
| CVE-2026-57088 | 7.8 high | 0.00% | microsoft, windows 10 version 1809, windows server 2019, windows server 2019 (server core installation) | Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally. | 19 h ago |
| CVE-2026-88143 | 7.8 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | 20 h ago |
| CVE-2026-70238 | 7.8 high | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | 23 h ago |
| CVE-2026-13451 | 7.7 high | — | no CPE yet | A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious `storageUri`. This Server-Side Request Forgery (SSRF) vulnerability allows the `storage-initializer` init container to issue arbitrary outbound HTTP/HTTPS requests from inside the cluster. This can lead to information disclosure, including credential theft for the node's Identity and Access Management (IAM) role or access to internal cluster services. | 19 h ago |
| CVE-2026-47235 | 7.5 high | — | no CPE yet | SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets` array uses `slot_data["sockets"].Size()` without bounding `gem_idx` by `MAX_GEM_SLOTS`, which is four in `engine/sc_enums.hpp`. The destination `gem_id` and `gem_bonus_id` arrays in `engine/item/item.hpp` have only four elements. More than four socket entries therefore write beyond `gem_id` into the adjacent `gem_bonus_id` vector storage; `bonus_list` entries can also access `gem_bonus_id` out of bounds. Corrupting a vector's `_M_start` pointer causes the `item_t` destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious `.simc` profile with a `[[equipment]]` section, a compromised addon export, or `Battle.net API` responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available. | 24 h ago |
| CVE-2026-109822 | 7.1 high | — | yamaha corporation, nwr100 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker. | 3 h ago |
| CVE-2026-58526 | 7.0 high | 0.00% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. | 19 h ago |
| CVE-2026-116776 | 7.0 high | — | no CPE yet | USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking whether the call succeeded or enforcing size bounds. USB Test/src/drivetest.cpp uses the value for division and to size a heap buffer before memcpy(buffer.data(), §or, 8), so a physically connected malicious USB storage device can report a value below eight bytes and cause repeated out-of-bounds writes, or report zero and cause a divide-by-zero denial of service when a user starts a drive test. The heap corruption can crash the elevated application and may permit arbitrary code execution. This issue is fixed in version 1.1.5. | 24 h ago |
| CVE-2026-93006 | 6.8 medium | — | red hat, red hat ceph storage 9, red hat enterprise linux 10, red hat enterprise linux 6 | A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine. | 3 h ago |
| CVE-2026-93008 | 6.8 medium | — | red hat, red hat ceph storage 9, red hat enterprise linux 10, red hat enterprise linux 6 | A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names. | 3 h ago |
| CVE-2026-50299 | 6.8 medium | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack. | 19 h ago |
| CVE-2026-49168 | 6.8 medium | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges with a physical attack. | 19 h ago |
| CVE-2026-96863 | 6.8 medium | 0.00% | microsoft, windows_11_23h2, windows_11_24h2, windows_11_25h2 | Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack. | 22 h ago |
| CVE-2026-118756 | 6.7 medium | — | no CPE yet | gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees. | 18 h ago |
| CVE-2026-55369 | 6.5 medium | — | no CPE yet | Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string (for example a JSON object such as {"$ne": null}), the MongoDB storage adapter's parseWhere silently DROPS the field rather than rejecting the request, producing an empty filter that matches ALL users. The endpoint then verifies the submitted password against the FIRST user returned (user[0]), which in Waline is the first-registered user — the site administrator. This is a PARTIAL authentication bypass, not a full one. The attacker still needs a valid password for that first user; this is not a zero-knowledge bypass and it does not disclose passwords. Its concrete effects are: (1) the email/identifier factor is removed for the administrator account, (2) user enumeration (a non-string email never fails the "no such user" branch), and (3) credential-stuffing amplification — an attacker can test a leaked or weak password against the administrator account without knowing the administrator's email. This issue has been patched in version 1.41.1. | 24 h ago |
| CVE-2026-88140 | 5.5 medium | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally. | 20 h ago |
| CVE-2026-111318 | 5.4 medium | — | devitemsllc, ht mega addons for elementor – elementor widgets & template builder | The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of <a> inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled whose markup allowlist permits span[class] and a[href] storage, an HT Mega Tabs widget present on the same page as the comment section, and a victim user click on the injected anchor link. | 5 h ago |
| CVE-2026-93007 | 5.3 medium | — | red hat, red hat ceph storage 9, red hat enterprise linux 10, red hat enterprise linux 6 | A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime. | 3 h ago |
| CVE-2026-93011 | 5.3 medium | — | red hat, red hat ceph storage 9, red hat enterprise linux 10, red hat enterprise linux 6 | A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime. | 3 h ago |
| CVE-2026-118643 | 5.3 medium | — | no CPE yet | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git passwords or tokens, MongoDB database passwords, or Google access tokens from that data. | 20 h ago |
| CVE-2026-114236 | 3.3 low | 0.00% | no CPE yet | storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit | 23 h ago |
25 of 25
Download these 25 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.