Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
CVSS critical ×
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-110447KEVexploitnews ×3 | 9.2 critical | 73.0% | collabora, online | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected. | Mon 26 Oct |
| CVE-2026-55040KEVexploit ×5 | 9.1 critical | 70.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. | Wed 28 Oct |
| CVE-2026-48356KEVexploit ×2 | 9.3 critical | 45.0% | adobe, commerce, commerce_b2b, magento | Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. | Wed 28 Oct |
| CVE-2026-102489KEVexploit ×3 | 9.4 critical | 22.0% | zammad | Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework. | 10 Oct |
| CVE-2026-97229KEVexploit ×4news ×4 | 10.0 critical | 18.0% | gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. | 14 Oct |
| CVE-2026-50522KEVexploit ×5 | 9.8 critical | 3.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2026-58644KEV | 9.8 critical | 16.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | Wed 28 Oct |
| CVE-2024-8517exploit ×3 | 9.8 critical | 95.0% | spip | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. | 8 h ago |
| CVE-2025-25034exploit | 9.3 critical | 5.0% | sugarcrm | A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC. | 8 h ago |
| CVE-2026-105192exploit | 9.8 critical | 1.0% | lmcache | LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect. The decode path shipped in v0.3.9 and is present through v0.5.5, including the v0.5.6 release candidates. v0.5.6, published on 2026-10-14, removes pickle.loads from this path. | 19 h ago |
| CVE-2017-20251exploit | 9.3 critical | 1.0% | themeisle, woody code snippets | WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server. | 8 h ago |
| CVE-2026-107327exploit | 9.9 critical | — | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization. | 1 h ago |
| CVE-2026-107328exploit | 9.9 critical | — | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec. | 1 h ago |
| CVE-2026-107329exploit | 9.9 critical | — | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. | 1 h ago |
| CVE-2026-93680exploit ×2 | 9.8 critical | — | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. | 1 h ago |
| CVE-2026-93903exploit | 9.4 critical | 0.00% | litespeedtech, litespeed web server | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case." | 14 h ago |
| CVE-2026-89010 | 9.3 critical | 3.0% | wavlink technology, wn535m1, wn535m3 | WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string via sprintf() and passes it to system() without sanitization, enabling root-level command execution on the device. | 11 h ago |
| CVE-2026-82854 | 9.3 critical | 2.0% | no CPE yet | Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope. | 9 h ago |
| CVE-2026-56379 | 9.2 critical | 2.0% | imagemagick | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering. | 8 h ago |
| CVE-2026-91221 | 10.0 critical | 1.0% | no CPE yet | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). | 11 h ago |
| CVE-2026-91231 | 10.0 critical | 1.0% | no CPE yet | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). | 11 h ago |
| CVE-2026-91216 | 10.0 critical | 1.0% | no CPE yet | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). | 12 h ago |
| CVE-2024-42360 | 9.8 critical | 1.0% | wurmlab, sequenceserver | SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands. This vulnerability has been fixed in 3.1.2. | 16 h ago |
| CVE-2023-53982 | 9.3 critical | 1.0% | sigb, pmb | PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the storage module (categ=storage) of the opac_css/ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements to extract information or perform time-based blind SQL injection attacks. | 8 h ago |
| CVE-2026-114358 | 9.3 critical | 1.0% | radius synergies, radius xenia m2m platform | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input fields to the targeted system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to sensitive information, enumerate database structure or modify database records on the targeted system. | 15 h ago |
| CVE-2025-15620 | 9.2 critical | 1.0% | belden, hirschmann hios switch platform | HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch. | 8 h ago |
| CVE-2026-84295 | 10.0 critical | — | progress software, ws_ftp server | Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials. | 1 h ago |
| CVE-2026-61991 | 10.0 critical | — | ajax load more, ajaxloadmore cache | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | 14 h ago |
| CVE-2026-90868 | 9.9 critical | — | progress software, ws_ftp server | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations. | 1 h ago |
| CVE-2026-91222 | 9.9 critical | 0.00% | no CPE yet | Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Business Process Management Suite. While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). | 11 h ago |
| CVE-2026-91224 | 9.9 critical | 0.00% | no CPE yet | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). | 11 h ago |
| CVE-2026-91232 | 9.9 critical | 0.00% | no CPE yet | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). | 11 h ago |
| CVE-2026-104339 | 9.8 critical | — | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | 1 h ago |
| CVE-2026-110186 | 9.8 critical | — | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | 1 h ago |
| CVE-2026-62013 | 9.8 critical | — | themerex, edge decor | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | 9 h ago |
| CVE-2026-62018 | 9.8 critical | — | themerex, gunslinger | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | 9 h ago |
| CVE-2026-62008 | 9.8 critical | — | themerex, orpheus | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | 10 h ago |
| CVE-2026-62002 | 9.8 critical | — | themerex, meals & wheels | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | 10 h ago |
| CVE-2026-54859 | 9.8 critical | — | themerex, preservation | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | 10 h ago |
| CVE-2026-54858 | 9.8 critical | — | themerex, printy | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | 12 h ago |
| CVE-2026-62001 | 9.8 critical | — | themerex, marcell | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | 12 h ago |
| CVE-2026-62006 | 9.8 critical | — | themerex, nuts | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | 12 h ago |
| CVE-2026-62012 | 9.8 critical | — | themerex, coinpress | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | 12 h ago |
| CVE-2026-62017 | 9.8 critical | — | themerex, good homes | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | 12 h ago |
| CVE-2026-62016 | 9.8 critical | — | themerex, gamic | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | 14 h ago |
| CVE-2026-62015 | 9.8 critical | — | themerex, gamezone | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | 14 h ago |
| CVE-2026-62014 | 9.8 critical | — | themerex, emojination | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | 14 h ago |
| CVE-2026-62011 | 9.8 critical | — | themerex, bonbon | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | 14 h ago |
| CVE-2026-62010 | 9.8 critical | — | themerex, avventure | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | 14 h ago |
| CVE-2026-62009 | 9.8 critical | — | themerex, filmax | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | 14 h ago |
50 of 87 · Next
Download these 87 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.