Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
EPSS no score ×
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-104286KEVexploit ×5 | 9.8 critical | — | fortinet, fortimail | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. | 5 h ago |
| CVE-2023-43000KEV | 8.8 high | — | apple, safari, ipados, iphone_os | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption. | 5 h ago |
| CVE-2026-56190exploit ×2 | 9.8 critical | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network. | 5 h ago |
| CVE-2026-50522exploit ×5 | 9.8 critical | — | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | 5 h ago |
| CVE-2026-116692exploit | 9.8 critical | — | no CPE yet | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES rather than requiring an exact allowed module. A caller can use MLflow artifact endpoints to place a Python module beneath a writable allowed package and submit its module and class through /ajax-api/3.0/mlflow/scorer/invoke. Scorer.model_validate_json() imports the module and constructs the class before trace processing. Authentication-disabled deployments permit this code execution without credentials, while basic-auth deployments require a principal capable of creating an experiment and run and uploading artifacts. In either configuration, the allowed scorer package must be writable by the server process. This issue is fixed in version 3.17.0. | 9 h ago |
| CVE-2026-117532exploit | 9.3 critical | — | no CPE yet | REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode. | Tue 27 Oct |
| CVE-2026-55040exploit ×5 | 9.1 critical | — | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. | 5 h ago |
| CVE-2026-54121exploit ×15 | 8.8 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network. | 5 h ago |
| CVE-2026-50369exploit | 8.8 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network. | 5 h ago |
| CVE-2026-47301exploit | 8.8 high | — | microsoft, microsoft configuration manager, microsoft configuration manager 2509, microsoft configuration manager 2603 | Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. | 5 h ago |
| CVE-2026-54107exploit | 8.8 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally. | 5 h ago |
| CVE-2023-49440exploit | 8.8 high | — | no CPE yet | AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter." | 5 h ago |
| CVE-2026-54992exploit | 8.4 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally. | 5 h ago |
| CVE-2026-50402exploit | 7.8 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally. | 5 h ago |
| CVE-2026-50343exploit | 7.8 high | — | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally. | 5 h ago |
| CVE-2026-58635exploit | 7.8 high | — | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally. | 5 h ago |
| CVE-2026-49176exploit ×2 | 7.8 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally. | 5 h ago |
| CVE-2023-52356exploit | 7.5 high | — | debian, apple, debian_linux, ipados, iphone_os | A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service. | 6 h ago |
| CVE-2024-27686exploit | 7.5 high | — | no CPE yet | Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the SMB service on TCP port 445. | 15 h ago |
| CVE-2024-45257exploit | 7.3 high | — | no CPE yet | A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on the server via a crafted build parameter. This occurs in freeze in core/generators.py. | 15 h ago |
| CVE-2024-46507exploit | 7.3 high | — | yeti-platform, yeti | A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server. | 15 h ago |
| CVE-2026-34348exploit | 6.5 medium | — | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network. | 5 h ago |
| CVE-2024-30167exploit ×2 | 6.3 medium | — | no CPE yet | /cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a POST request that carries a serverName parameter. | 15 h ago |
| CVE-2024-33722exploit | 6.3 medium | — | no CPE yet | SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[]. | 15 h ago |
| CVE-2023-32070exploit | 6.1 medium | — | xwiki, rendering | XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version. | 5 h ago |
| CVE-2023-0902exploit ×2 | 5.4 medium | — | simple_food_ordering_system_project, simple_food_ordering_system | A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451. | 5 h ago |
| CVE-2026-56164exploit ×2 | 5.3 medium | — | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | 5 h ago |
| CVE-2023-47268exploit ×2 | 5.3 medium | — | prusa3d, prusaslicer | In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported. | 5 h ago |
| CVE-2026-50416exploit ×2 | 3.3 low | — | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. | 5 h ago |
| CVE-2025-67315exploit | unscored | — | no CPE yet | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. | 19 Oct |
| CVE-2017-4490exploit ×2 | unscored | — | no CPE yet | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none | 18 Oct |
| CVE-2022-20128exploit | unscored | — | no CPE yet | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 18 Oct |
| CVE-2025-62639exploit | unscored | — | no CPE yet | Rejected reason: Not used | 18 Oct |
| CVE-2017-4878exploit | unscored | — | no CPE yet | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none | 16 Oct |
| CVE-2024-7804exploit | unscored | — | no CPE yet | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 16 Oct |
| CVE-2025-1234exploit | unscored | — | no CPE yet | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 16 Oct |
| CVE-2026-12243exploit | unscored | — | no CPE yet | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 16 Oct |
| CVE-2024-12537exploit | unscored | — | no CPE yet | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 16 Oct |
| CVE-2026-61567 | 10.0 critical | — | no CPE yet | AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant `isLogged` and `canStream` without legitimate credentials. The endpoint requires only nonempty `playlists_id` and `APISecret` values; `APISecret` is forwarded rather than checked against a stored secret. This path never calls `Streamer::isURLAllowed` and therefore works regardless of the operator's streamer allowlist. It fetches a second attacker-controlled video-list response and interpolates `videos[].path` without shell argument escaping into `ffprobe` and `ffmpeg` commands passed to `exec`; `isAudio` calls `isVideo` to reach the `ffprobe` command. Paths containing shell delimiters execute arbitrary operating-system commands as the web-server user. The request filter does not inspect the video-list JSON. This can disclose database and stored streamer credentials, compromise the upstream platform using those credentials, modify files owned by the web-server user, establish persistence, and deny encoder service. This issue is fixed in version 8.1.0. | 3 h ago |
| CVE-2026-61564 | 10.0 critical | — | no CPE yet | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php and a connection using `databaseHost`, `databaseUser`, and `databasePass` must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from `systemRootPath` without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0. | 3 h ago |
| CVE-2026-105781 | 10.0 critical | — | no CPE yet | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. | 10 h ago |
| CVE-2026-65145 | 10.0 critical | — | no CPE yet | NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. | Tue 27 Oct |
| CVE-2026-57092 | 9.9 critical | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network. | 5 h ago |
| CVE-2026-44179 | 9.9 critical | — | no CPE yet | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` content with the macro's rights. The title handling in `xwiki-pro-macros-ui/src/main/resources/Confluence/Macros/ExcerptInclude.xml` and the rendering of `excerpt` content into XWiki syntax both allow syntax injection. Any user able to edit a page, even without script or programming rights, can supply executable macro syntax in the title or `excerpt` and cause remote code execution when the page is included. This affects confidentiality, integrity and availability of the whole XWiki installation. This issue is fixed in version 1.14.5. | 9 h ago |
| CVE-2026-104351 | 9.9 critical | — | no CPE yet | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | 10 h ago |
| CVE-2026-104353 | 9.9 critical | — | no CPE yet | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | 10 h ago |
| CVE-2026-105780 | 9.9 critical | — | no CPE yet | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | 10 h ago |
| CVE-2026-105489 | 9.9 critical | — | no CPE yet | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | 11 h ago |
| CVE-2026-47304 | 9.8 critical | — | microsoft, .net_framework, .net, visual_studio_2017 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. | 4 h ago |
| CVE-2026-56188 | 9.8 critical | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network. | 5 h ago |
50 of 8865 · Next
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-27. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.