Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-62564 | 7.8 high | 1.0% | microsoft, 365_apps, excel, office | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2026-55488 | 7.7 high | 1.0% | no CPE yet | motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Versions prior to 0.44.0 contain an absolute path traversal vulnerability in multiple media file handlers that allows an attacker to read arbitrary files from the filesystem. The affected handlers accept a user-controlled filename parameter and construct filesystem paths using `os.path.join()`. When an absolute path is supplied, Python discards the configured media directory and returns the attacker-supplied path directly. The application then bypasses Tornado's built-in path validation by overriding the relevant safety checks. As a result, an attacker can access files outside of the configured camera media directory, subject to the permissions of the motionEye process. Version 0.44.0 fixes the issue. | Sun 25 Oct |
| CVE-2026-32210 | 7.5 high | 1.0% | microsoft, dynamics_365 | Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network. | Mon 26 Oct |
| CVE-2026-96185 | 7.5 high | 1.0% | no CPE yet | Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network. | Sat 24 Oct |
| CVE-2026-110284 | 7.5 high | 1.0% | no CPE yet | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. This is due to the llms_get_template() helper performing extract() on the shortcode attribute array before resolving the template path, which allows the attacker-supplied 'template_name' and 'default_path' shortcode attributes to overwrite the function's local parameters and ultimately control the path passed to a PHP include. This makes it possible for authenticated attackers, with Instructor-level access and above, to include and execute arbitrary files on the server, that can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with safe extensions containing attacker-controlled content can be uploaded and included. | 15 Oct |
| CVE-2026-48787 | 7.4 high | 1.0% | no CPE yet | gin-vue-admin is an AI-assisted basic development platform. In version 2.9.1, an authenticated attacker with access to the code-generation feature and MCP management interface can exploit this vulnerability by injecting attacker-controlled Go source code through POST /autoCode/addFunc, and then invoking POST /autoCode/mcpStart to trigger a rebuild and restart of the standalone MCP service. This allows arbitrary operating system commands to be executed on the server with the privileges of the application process. Successful exploitation may lead to remote code execution (RCE), modification of backend source code or runtime logic, deployment of persistent backdoors, access to or manipulation of application data and configuration, and further impact on local resources running under the same service account or privilege context. The risk is highest in deployments that retain the source tree, allow writes to source files, and support local build or startup of standalone MCP components. In environments using binary-only releases, read-only filesystems, or with local build capabilities removed, the exploitability of the full attack chain is significantly reduced. However, once the online code-generation capability and MCP-hosted startup workflow are enabled, the overall security impact may reach high to critical severity. As of time of publication, it is unknown if a patched version is available. As a workaround, enforce strict allowlist validation on path- and identifier-related fields such as `humpPackageName`, `packageName`, `FuncName`, and `Router`, and only permit safe identifier formats. | Sun 25 Oct |
| CVE-2026-55122 | 7.1 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2025-60726 | 7.1 high | 1.0% | microsoft, 365_apps, excel, office | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 18 Oct |
| CVE-2025-62202 | 7.1 high | 1.0% | microsoft, 365_apps, excel, office | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 18 Oct |
| CVE-2026-15491 | 6.9 medium | 1.0% | no CPE yet | A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation causes missing authentication. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way. | Sun 25 Oct |
| CVE-2026-75928 | 6.9 medium | 1.0% | no CPE yet | The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026. | 15 Oct |
| CVE-2026-70328 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | Wed 28 Oct |
| CVE-2026-70327 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | Wed 28 Oct |
| CVE-2026-55054 | 6.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | Wed 28 Oct |
| CVE-2026-97779 | 6.5 medium | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 15 Oct |
| CVE-2026-97760 | 6.5 medium | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 15 Oct |
| CVE-2026-97740 | 6.5 medium | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 15 Oct |
| CVE-2023-42343 | 6.1 medium | 1.0% | no CPE yet | A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. | Wed 28 Oct |
| CVE-2026-68799 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-68797 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-68808 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-68802 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-55138 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-55046 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-50408 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-48580 | 5.5 medium | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-116604 | 5.5 medium | 1.0% | no CPE yet | A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete_admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | Tue 27 Oct |
| CVE-2026-0578 | 5.5 medium | 1.0% | fabian, online_product_reservation_system | A vulnerability has been found in code-projects Online Product Reservation System 1.0. Affected by this issue is some unknown functionality of the file /handgunner-administrator/delete.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | Mon 26 Oct |
| CVE-2026-0589 | 5.5 medium | 1.0% | fabian, online_product_reservation_system | A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administration Backend. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has been made public and could be used. | Mon 26 Oct |
| CVE-2026-14648 | 5.5 medium | 1.0% | no CPE yet | A security vulnerability has been detected in code-projects Online Voting System up to 0.x/1.0. This issue affects the function test_input of the file /authentication.php of the component Login. Such manipulation of the argument adminUserName/adminPassword leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. | Sun 25 Oct |
| CVE-2026-19229 | 5.5 medium | 1.0% | no CPE yet | A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functionality of the file /_notes/ of the component Dreamweaver Metadata Files. Executing a manipulation can lead to file and directory information exposure. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. | Fri 23 Oct |
| CVE-2025-9660 | 5.5 medium | 1.0% | janobe, bakeshop_online_ordering_system | A vulnerability was found in SourceCodester Bakeshop Online Ordering System 1.0. The impacted element is an unknown function of the file /passwordrecover.php. Performing manipulation of the argument phonenumber results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. | 18 Oct |
| CVE-2025-9692 | 5.5 medium | 1.0% | campcodes, online_shopping_system | A vulnerability was found in Campcodes Online Shopping System 1.0. Affected is an unknown function of the file /product.php. Performing manipulation of the argument p results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. | 18 Oct |
| CVE-2025-9694 | 5.5 medium | 1.0% | campcodes, advanced_online_voting_system | A vulnerability was determined in Campcodes Advanced Online Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. Executing manipulation of the argument Username can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. | 18 Oct |
| CVE-2025-9699 | 5.5 medium | 1.0% | razormist, online_polling_system | A vulnerability was detected in SourceCodester Online Polling System Code 1.0. This vulnerability affects unknown code of the file /admin/checklogin.php. The manipulation of the argument myusername results in sql injection. The attack may be performed from a remote location. The exploit is now public and may be used. | 18 Oct |
| CVE-2025-10841 | 5.5 medium | 1.0% | fabian, online_bidding_system | A security vulnerability has been detected in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/weweee.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. | 11 Oct |
| CVE-2025-11422 | 5.5 medium | 1.0% | campcodes, advanced_online_voting_system | A vulnerability has been found in Campcodes Advanced Online Voting Management System 1.0. The impacted element is an unknown function of the file /admin/login.php. Such manipulation of the argument Username leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. | 8 Oct |
| CVE-2025-12257 | 5.5 medium | 1.0% | oretnom23, online_student_result_system | A security vulnerability has been detected in SourceCodester Online Student Result System 1.0. This issue affects some unknown processing of the file /view_result.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. | 8 Oct |
| CVE-2026-26032 | 5.4 medium | 1.0% | apache, ivy | The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on modules coordinates, like the organisation, name or version. If one of the coordinates contains "../" sequences - which are valid characters for Ivy coordinates in general- it is possible to break out of the configured "buildRoot" directory where other files can be overwritten. In order to exploit this vulnerability an attacker needs to have access to a packager repository and add or modify the coordinates in ivy.xml files to have such "../" sequences. Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0. | Sat 24 Oct |
| CVE-2023-0785 | 3.7 low | 1.0% | mayurik, best_online_news_portal | A vulnerability classified as problematic was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unknown functionality of the file check_availability.php. The manipulation of the argument username leads to exposure of sensitive information through data queries. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-220645 was assigned to this vulnerability. | Wed 28 Oct |
| CVE-2026-3832 | 3.7 low | 1.0% | gnu, redhat, gnutls, hardened_images, openshift_container_platform | A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust. | Mon 26 Oct |
| CVE-2026-42858 | 9.9 critical | 0.00% | openedx | Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply an arbitrary URL via the metadata_url POST parameter. This URL is passed directly to requests.get() in fetch_metadata_xml() without any URL validation, IP filtering, or scheme enforcement. An attacker with Enterprise Admin privileges can force the server to make HTTP requests to internal network services, cloud metadata endpoints (e.g., AWS 169.254.169.254), or other attacker-controlled destinations. This vulnerability is fixed by commit 6fda1f120ff5a590d120ae1180185525f399c6d0 and 70a56246dd9c9df57c596e64bdd8a11b1d9da054. | Mon 26 Oct |
| CVE-2026-40750 | 9.9 critical | 0.00% | no CPE yet | Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affects Kids Online Store: from n/a through 0.8.9. | Mon 26 Oct |
| CVE-2025-58448 | 9.8 critical | 0.00% | rathena | rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection in the PartyBooking component via `WorldName` parameter. Commit 0d89ae0 fixes the issue. | 19 Oct |
| CVE-2026-54458 | 9.6 critical | 0.00% | no CPE yet | WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugin/YPTSocket/MessageSQLiteV2.php lines 91 and 110 reads the attacker-controlled webSocketSelfURI and page_title query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite connections table and broadcast inside the users_id_online array sent to every connected client; on the client, plugin/YPTSocket/script.js::updateSocketUserCard interpolates the broadcast page_title into an HTML template literal that is passed to jQuery $.append(html), which parses attacker bytes into live DOM nodes including <img> with inline event handlers. Successful attackers can can read non-HttpOnly cookies and the CSRF token rendered into the admin dashboard, issue authenticated requests to any admin-only endpoint, exfiltrate the admin dashboard DOM, and chain into any admin-context mutation. When the victim is an AVideo administrator, the attacker turns a single anonymous WebSocket connection into full administrative takeover via the admin's own session. This issue has been patched by https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16. | Sat 24 Oct |
| CVE-2026-35044 | 9.6 critical | 0.00% | bentoml | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the Dockerfile generation function generate_containerfile() in src/bentoml/_internal/container/generate.py uses an unsandboxed jinja2.Environment with the jinja2.ext.do extension to render user-provided dockerfile_template files. When a victim imports a malicious bento archive and runs bentoml containerize, attacker-controlled Jinja2 template code executes arbitrary Python directly on the host machine, bypassing all container isolation. This vulnerability is fixed in 1.4.38. | Fri 23 Oct |
| CVE-2026-42155 | 9.3 critical | 0.00% | no CPE yet | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, the XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). All inputs to the MD5 hash are time-derived and non-secure. Because the resulting digest relies entirely on the timestamp and the PHP internal LCG state, the effective entropy is severely constrained. This violates the OWASP ASVS v4 requirement of ≥ 64 bits of entropy (V3.2.2) and NIST SP 800-63B standards. By narrowing the LCG window (via server state leaks or general predictability) and leveraging the lack of API rate-limiting, an attacker can generate a localized pool of candidate MD5 hashes and execute a high-speed online brute-force attack to hijack active API sessions. This vulnerability is fixed in 20.18.0. | Mon 26 Oct |
| CVE-2026-44828 | 9.3 critical | 0.00% | no CPE yet | Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0. | 16 Oct |
| CVE-2025-58750 | 9.1 critical | 0.00% | rathena | rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b. | 19 Oct |
| CVE-2026-70747 | 8.8 high | 0.00% | oracle, customers_online | Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Customer Tab). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in takeover of Oracle Customers Online. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | 22 Oct |
Download these 572 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.