Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-104286KEVexploit ×5 | 9.8 critical | — | fortinet, fortimail | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. | 3 h ago |
| CVE-2024-51092exploit | 9.1 critical | 7.0% | librenms | LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController.php's update(), and PollDevice.php's initRrdDirectory(). | Tue 27 Oct |
| CVE-2026-56190exploit ×2 | 9.8 critical | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network. | 3 h ago |
| CVE-2026-50522exploit ×5 | 9.8 critical | — | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | 3 h ago |
| CVE-2026-55040exploit ×5 | 9.1 critical | — | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network. | 3 h ago |
| CVE-2026-54121exploit ×15 | 8.8 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network. | 3 h ago |
| CVE-2026-50369exploit | 8.8 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network. | 3 h ago |
| CVE-2026-47301exploit | 8.8 high | — | microsoft, microsoft configuration manager, microsoft configuration manager 2509, microsoft configuration manager 2603 | Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. | 3 h ago |
| CVE-2026-54107exploit | 8.8 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally. | 3 h ago |
| CVE-2023-49440exploit | 8.8 high | — | no CPE yet | AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter." | 4 h ago |
| CVE-2026-54992exploit | 8.4 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally. | 3 h ago |
| CVE-2026-50402exploit | 7.8 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally. | 3 h ago |
| CVE-2026-50343exploit | 7.8 high | — | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally. | 3 h ago |
| CVE-2026-58635exploit | 7.8 high | — | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally. | 3 h ago |
| CVE-2026-49176exploit ×2 | 7.8 high | — | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally. | 3 h ago |
| CVE-2023-52356exploit | 7.5 high | — | debian, apple, debian_linux, ipados, iphone_os | A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service. | 4 h ago |
| CVE-2024-27686exploit | 7.5 high | — | no CPE yet | Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the SMB service on TCP port 445. | 14 h ago |
| CVE-2024-45257exploit | 7.3 high | — | no CPE yet | A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on the server via a crafted build parameter. This occurs in freeze in core/generators.py. | 14 h ago |
| CVE-2024-46507exploit | 7.3 high | — | yeti-platform, yeti | A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server. | 14 h ago |
| CVE-2024-53326exploit | 7.3 high | 0.00% | no CPE yet | LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code execution. | Tue 27 Oct |
| CVE-2026-34348exploit | 6.5 medium | — | microsoft, windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 | Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network. | 3 h ago |
| CVE-2024-30167exploit ×2 | 6.3 medium | — | no CPE yet | /cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a POST request that carries a serverName parameter. | 14 h ago |
| CVE-2024-33722exploit | 6.3 medium | — | no CPE yet | SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[]. | 14 h ago |
| CVE-2023-32070exploit | 6.1 medium | — | xwiki, rendering | XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting (XSS) attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. There are no known workarounds apart from upgrading to a fixed version. | 4 h ago |
| CVE-2023-0902exploit ×2 | 5.4 medium | — | simple_food_ordering_system_project, simple_food_ordering_system | A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451. | 4 h ago |
| CVE-2026-56164exploit ×2 | 5.3 medium | — | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. | 3 h ago |
| CVE-2023-47268exploit ×2 | 5.3 medium | — | prusa3d, prusaslicer | In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported. | 4 h ago |
| CVE-2026-50416exploit ×2 | 3.3 low | — | microsoft, windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 | Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. | 3 h ago |
28 of 28
Download these 28 as CSV · subscribe to this list.
EPSS scores: 2026-10-27. NVD cursor: 2026-10-28 23:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.