Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
CVSS medium ×
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-105133KEVexploit | 6.9 medium | 79.0% | ahsay, cloud_backup_suite | A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary. | Mon 26 Oct |
| CVE-2026-42897KEVexploit | 6.1 medium | 71.0% | microsoft, exchange_server, exchange_server_subscription_edition | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | Mon 26 Oct |
| CVE-2026-32202KEVexploit ×4 | 4.3 medium | 71.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. | Mon 26 Oct |
| CVE-2026-32201KEVexploit | 6.5 medium | 43.0% | microsoft, sharepoint_server | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | Mon 26 Oct |
| CVE-2025-55177KEVexploit | 5.4 medium | 13.0% | whatsapp, whatsapp_business | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users. | 18 Oct |
| CVE-2026-60137KEVexploit ×13 | 5.9 medium | 5.0% | wordpress | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter. | 8 Oct |
| CVE-2023-22894KEVexploit ×2 | 4.9 medium | 4.0% | strapi | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts. | 9 Oct |
| CVE-2025-39964KEVexploit ×2 | 5.5 medium | 2.0% | linux, siemens, linux_kernel, simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware, simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing. | 19 Oct |
| CVE-2026-96652KEVexploit ×7 | 5.3 medium | 2.0% | plex, media_server | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. | 21 Oct |
| CVE-2026-7473KEVexploit | 6.9 medium | 1.0% | arista, eos | On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild. | Sun 25 Oct |
| CVE-2026-66384KEVexploit | 5.3 medium | 1.0% | jfrog, artifactory | An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. | Sat 24 Oct |
| CVE-2026-20316KEV | 5.3 medium | 35.0% | cisco, secure_firewall_management_center | A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced. Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges. | Sat 24 Oct |
| CVE-2026-96654KEV | 6.9 medium | 2.0% | plex, media_server | Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters. | 21 Oct |
| CVE-2026-96655KEV | 5.3 medium | 2.0% | plex, media_server | Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. | 21 Oct |
| CVE-2025-61624KEV | 6.5 medium | 1.0% | fortinet, siemens, fortios, fortipam, fortiproxy | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. | 17 Oct |
| CVE-2024-50302KEV | 5.5 medium | 1.0% | google, debian, android, debian_linux, simatic_s7-1500_tm_mfp_firmware | In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report. | 15 Oct |
16 of 16
Download these 16 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.