Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-62006 | 9.8 critical | — | themerex, nuts | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | 4 h ago |
| CVE-2026-62005 | 9.8 critical | — | themerex, muzicon | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | 4 h ago |
| CVE-2026-62004 | 9.8 critical | — | themerex, motorix | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | 4 h ago |
| CVE-2026-62003 | 9.8 critical | — | themerex, mission | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | 4 h ago |
| CVE-2026-62002 | 9.8 critical | — | themerex, meals & wheels | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | 4 h ago |
| CVE-2026-62001 | 9.8 critical | — | themerex, marcell | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | 4 h ago |
| CVE-2026-61998 | 9.8 critical | — | themerex, le truffe | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | 4 h ago |
| CVE-2026-61997 | 9.8 critical | — | themerex, legal stone | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | 4 h ago |
| CVE-2026-54860 | 9.8 critical | — | themerex, ozisti | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | 4 h ago |
| CVE-2026-54859 | 9.8 critical | — | themerex, preservation | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | 4 h ago |
| CVE-2026-54858 | 9.8 critical | — | themerex, printy | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | 4 h ago |
| CVE-2026-54857 | 9.8 critical | — | themerex, quirky | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | 4 h ago |
| CVE-2026-54856 | 9.8 critical | — | themerex, rexcoin | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | 4 h ago |
| CVE-2026-62131 | 9.8 critical | — | zoho flow | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | 4 h ago |
| CVE-2026-61992 | 9.8 critical | — | von eyal fitoussi, geo my wordpress | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | 4 h ago |
| CVE-2026-104339 | 9.8 critical | — | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | 4 h ago |
| CVE-2026-110186 | 9.8 critical | — | ibm, langflow oss | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | 4 h ago |
| CVE-2024-42360 | 9.8 critical | — | wurmlab, sequenceserver | SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands. This vulnerability has been fixed in 3.1.2. | 6 h ago |
| CVE-2026-42922 | 9.8 critical | — | frangoteam | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. | 6 h ago |
| CVE-2026-109516 | 9.8 critical | — | guruteam, bot for telegram on woocommerce | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback => '__return_true'` and performs no Telegram webhook signature verification, allowing an unauthenticated attacker to POST a forged bot update with a `message.chat.id` set to any WordPress login name; `bftow_get_user_system_id()` resolves this attacker-supplied value to the targeted account via `get_user_by('login', $tgId)` with no ownership proof, and writes a login token computed as `md5($_SERVER['HTTP_USER_AGENT'] . time())` — both inputs are fully attacker-controlled or bounded within seconds using the response's own `Date` header. The resulting token is redeemable at the unauthenticated, capability-check-free, and nonce-less `?action=bftow_create_order&bftow_token=` endpoint, which calls `wp_set_auth_cookie()` unconditionally via `login_user_by_id`, issuing a persistent authenticated session cookie for the targeted account to the attacker. This makes it possible for unauthenticated attackers to log in as any WordPress user, including administrators, given only that user's username. | 8 h ago |
| CVE-2026-47304 | 9.8 critical | 0.00% | microsoft, .net_framework, .net, visual_studio_2017 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. | 23 h ago |
| CVE-2026-119145 | 9.4 critical | — | frappe | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server. | 3 h ago |
| CVE-2026-66088 | 9.4 critical | — | apereo foundation, openequella | In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account. | 17 h ago |
| CVE-2026-63190 | 9.4 critical | — | no CPE yet | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development server, including the default Docker deployment, `router.php` checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so `/./admin/` bypasses the admin login gate and executes those scripts directly. In `admin/debug_save_flow.php`, attacker-controlled `path` and `content` reach `file_put_contents` for arbitrary `.md` writes under `content`/ or outside it through `path` traversal, enabling site defacement and stored JavaScript in public pages; `print_r($_POST)` output without `htmlspecialchars` escaping also causes reflected cross-site scripting. The `admin/debug_content.php` `path` parameter reaches `scandir()`, `file_get_contents()` and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that expose absolute paths, ownership, permissions, hashes and `content` previews. The `admin/preview-handler.php` endpoint accepts JSON `content` and `title` and writes enumerable files under `content/_preview/`, enabling stored cross-site scripting and disk exhaustion. The `admin/testdebug.php` endpoint appends to `admin/testdebug.log` without authentication, also enabling disk exhaustion. The `admin/test_redirect.php` script exposes a test artifact but escapes its inputs and is not itself an XSS sink. Stored script execution can steal sessions and compromise administrators when they view affected `content`. Reads and writes execute with PHP's privileges; the tested deployment runs PHP as root, amplifying filesystem impact. This issue is fixed in version 0.1.4. | 24 h ago |
| CVE-2026-118762 | 9.3 critical | — | monkeytypegame, monkeytype | Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the fork-controlled oxfmt binary. Because actions/checkout persists the elevated GITHUB_TOKEN in Git configuration until after untrusted code executes, an external contributor whose pull request receives the format label can run arbitrary code, read or exfiltrate the token, and push repository content or modify pull requests and issues. The issue affects the repository CI workflow, not the Monkeytype application or user data. This issue is fixed in version 26.43.0. | 2 h ago |
| CVE-2026-111732 | 9.3 critical | — | rt-labs, p-net | P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block length. A crafted Connect request causes an out-of-bounds write. This can lead to a crash (denial of service) or potentially arbitrary code execution. This option is disabled by default. | 3 h ago |
| CVE-2026-114358 | 9.3 critical | — | radius synergies, radius xenia m2m platform | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input fields to the targeted system. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to sensitive information, enumerate database structure or modify database records on the targeted system. | 5 h ago |
| CVE-2026-115964 | 9.3 critical | — | stylemixthemes, motors | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126. | 7 h ago |
| CVE-2026-97854 | 9.3 critical | — | yamaha corporation, nwr100 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product. | 7 h ago |
| CVE-2026-32557 | 9.3 critical | — | bookingwp, woocommerce appointments | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BookingWP WooCommerce Appointments woocommerce-appointments allows Blind SQL Injection.This issue affects WooCommerce Appointments: from n/a through 5.3.2. | 12 h ago |
| CVE-2026-118690 | 9.3 critical | — | no CPE yet | Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control. | 22 h ago |
| CVE-2026-49798 | 9.3 critical | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally. | 23 h ago |
| CVE-2023-54342 | 9.3 critical | 0.00% | no CPE yet | Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to execute arbitrary code by exploiting the fork command functionality. Attackers can establish a telnet connection to the OSGi console, perform a telnet handshake, and send fork commands to download and execute malicious Java code, establishing a reverse shell connection. | 24 h ago |
| CVE-2026-112256 | 9.2 critical | — | opentext, advanced authentication server | Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0. | 4 h ago |
| CVE-2026-119050 | 9.2 critical | — | agno-agi, agno | Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files. | 6 h ago |
| CVE-2026-118633 | 9.2 critical | — | no CPE yet | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually. | Wed 28 Oct |
| CVE-2026-119128 | 9.1 critical | — | zitadel | ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser fingerprint to set a password, register a passkey, or link an identity provider, taking over the account. | 3 h ago |
| CVE-2026-90866 | 9.1 critical | — | progress software, ws_ftp server | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution. | 3 h ago |
| CVE-2026-90864 | 9.1 critical | — | progress software, ws_ftp server | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope. | 3 h ago |
| CVE-2026-90863 | 9.1 critical | — | progress software, ws_ftp server | Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server. | 3 h ago |
| CVE-2026-117574 | 9.1 critical | — | no CPE yet | A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas. | 23 h ago |
| CVE-2023-24215 | 9.1 critical | 0.00% | no CPE yet | Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administrator credentials via a crafted POST request. | 24 h ago |
| CVE-2026-118264 | 9.1 critical | — | no CPE yet | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1. | Wed 28 Oct |
| CVE-2026-90865 | 9.0 critical | — | progress software, ws_ftp server | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations. | 3 h ago |
| CVE-2026-118579 | 8.9 high | — | no CPE yet | A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. | 20 h ago |
| CVE-2026-116399 | 8.8 high | — | instawp, instawp connect | Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2. | 2 h ago |
| CVE-2026-118082 | 8.8 high | — | buddyboss, buddyboss platform | Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. | 4 h ago |
| CVE-2026-118081 | 8.8 high | — | 10web, 10web social photo feed | Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. | 4 h ago |
| CVE-2026-118080 | 8.8 high | — | social snap | Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. | 4 h ago |
| CVE-2026-118076 | 8.8 high | — | frisbii, frisbii pay | Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. | 4 h ago |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.