Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
CVSS medium ×
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2023-0902exploit ×2 | 5.4 medium | 3.0% | simple_food_ordering_system_project, simple_food_ordering_system | A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451. | 16 h ago |
| CVE-2026-34348exploit | 6.5 medium | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network. | 15 h ago |
| CVE-2023-32070exploit | 6.1 medium | 1.0% | xwiki, rendering | XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version. | 16 h ago |
| CVE-2026-56164exploit ×2 | 5.3 medium | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | 15 h ago |
| CVE-2023-47268exploit ×2 | 5.3 medium | 1.0% | prusa3d, prusaslicer | In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported. | 16 h ago |
| CVE-2026-114101exploit ×2 | 6.3 medium | 0.00% | no CPE yet | Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*. | 22 h ago |
| CVE-2026-117511 | 5.5 medium | 2.0% | no CPE yet | A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | 22 h ago |
| CVE-2026-102815 | 6.9 medium | 1.0% | no CPE yet | An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the TDDPv1 service and execute operating-system commands with root privileges. Successful exploitation may allow a local attacker with low privileges to obtain root privileges and execute arbitrary operating-system commands on the affected device. | 21 h ago |
| CVE-2026-58528 | 6.8 medium | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack. | 15 h ago |
| CVE-2026-50426 | 6.8 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network. | 15 h ago |
| CVE-2026-83573 | 6.8 medium | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthorized attacker to elevate privileges with a physical attack. | 16 h ago |
| CVE-2026-86383 | 6.8 medium | 1.0% | no CPE yet | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure. | Wed 28 Oct |
| CVE-2026-66324 | 6.5 medium | 1.0% | microsoft, edge_chromium | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 14 h ago |
| CVE-2026-62902 | 6.5 medium | 1.0% | microsoft, visual_studio_2022, visual_studio_2026, .net | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-40375 | 6.5 medium | 1.0% | microsoft, dynamics_365_business_central_2024, dynamics_365_business_central_2025, dynamics_365_business_central_2026 | Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-58539 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-58546 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-58535 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-58533 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-57982 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-56168 | 6.5 medium | 1.0% | microsoft, windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 | Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-54116 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2025 (cu 6), microsoft sql server 2025 for x64-based systems (gdr) | Access of resource using incompatible type ('type confusion') in SQL Server allows an authorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-50468 | 6.5 medium | 1.0% | microsoft, microsoft sql server 2025 (cu 6), microsoft sql server 2025 for x64-based systems (gdr) | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-55051 | 6.5 medium | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-55054 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-54126 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-50504 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-50497 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-50445 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-50376 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-50366 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-49799 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-57979 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2026-57976 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-54108 | 6.5 medium | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 15 h ago |
| CVE-2026-55003 | 6.5 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | 15 h ago |
| CVE-2023-0697 | 6.5 medium | 1.0% | google, chrome | Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote attacker to spoof the contents of the security UI via a crafted HTML page. (Chromium security severity: High) | 16 h ago |
| CVE-2023-0704 | 6.5 medium | 1.0% | google, chrome | Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML page. (Chromium security severity: Low) | 16 h ago |
| CVE-2023-0749 | 6.5 medium | 1.0% | oceanwp, ocean_extra | The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones. | 16 h ago |
| CVE-2023-25166 | 6.5 medium | 1.0% | hapi, formula | formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability. | 16 h ago |
| CVE-2023-27270 | 6.5 medium | 1.0% | sap, netweaver_application_server_abap | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain parameters, which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information. | 16 h ago |
| CVE-2023-31101 | 6.5 medium | 1.0% | apache, inlong | Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0. Users registered in InLong who joined later can see deleted users' data. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 to solve it. | 16 h ago |
| CVE-2026-70072 | 6.5 medium | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Allocation of resources without limits or throttling in Windows Netlogon allows an authorized attacker to deny service over a network. | 19 h ago |
| CVE-2026-57097 | 6.4 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack. | 15 h ago |
| CVE-2026-57184 | 6.3 medium | 1.0% | no CPE yet | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. | 10 h ago |
| CVE-2026-49807 | 6.2 medium | 1.0% | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally. | 15 h ago |
| CVE-2026-50294 | 6.2 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally. | 15 h ago |
| CVE-2026-50453 | 6.1 medium | 1.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack. | 15 h ago |
| CVE-2023-0606 | 6.1 medium | 1.0% | ampache | Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7. | 16 h ago |
| CVE-2023-42343 | 6.1 medium | 1.0% | no CPE yet | A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. | 16 h ago |
50 of 777 · Next
Download these 777 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.