Latest Vulnerabilities

CVE-2026-10062

TRENDnet TEW-432BRP formSetRoute Function Vulnerability

CVE-2026-10063

TRENDnet TEW-432BRP formWPS Function Vulnerability

CVE-2018-25388

HaPe PKH Arbitrary File Upload Vulnerability

CVE-2026-10066

Shibby Tomato tomatoups.cgi Function Vulnerability

CVE-2026-10067

Shibby Tomato multimon.cgi Stack-Based Buffer Overflow

CVE-2026-9227

GutenBee – Gutenberg Blocks plugin for WordPress Arbitrary File Upload

CVE-2026-6226

Frontend Admin by DynamiApps plugin for WordPress Unauthenticated Privilege Escalation

CVE-2026-10002

Google Chrome PDFium Use-After-Free Vulnerability

CVE-2026-9887

Google Chrome Proxy Use-After-Free Vulnerability

CVE-2026-0257

Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

CVE-2026-5065

IBM Controller Hard-Coded Credentials Vulnerability

CVE-2026-8179

IBM Aspera High-Speed Transfer Privilege Escalation

CVE-2026-7802

WordPress Frontend Admin Authorization Bypass

CVE-2026-9009

WordPress Crawlomatic Plugin Remote Code Execution

CVE-2026-9227

WordPress GutenBee Plugin Arbitrary File Upload

CVE-2026-46368

luci-app-https-dns-proxy through 2025.12.29-5

CVE-2026-44832

Snipe-IT Privilege Escalation Vulnerability

CVE-2026-48027

Nx Console - Nx Console Embedded Malicious Code Vulnerability

CVE-2026-45321

TanStack - TanStack Unspecified Vulnerability

CVE-2026-8398

Daemon Tools Lite - Daemon Tools Lite Embedded Malicious Code Vulnerability

CVE-2026-9442

Edimax BR-6478AC formiNICSiteSurvey Function Vulnerability

CVE-2026-9443

Edimax BR-6478AC formL2TPSetup Function Vulnerability

CVE-2026-9459

Edimax EW-7438RPn formConnectionSetting Function Vulnerability

CVE-2026-9460

Edimax EW-7438RPn formAccept Function Vulnerability

CVE-2026-48172

LiteSpeed cPanel Plugin Privilege Escalation Vulnerability

CVE-2026-47114

IINA User-Assisted Command Execution Vulnerability

CVE-2026-47101

LiteLLM API Key Privilege Escalation

CVE-2026-47102

LiteLLM User Role Modification Vulnerability

CVE-2026-9018

Easy Elements for Elementor Privilege Escalation

CVE-2026-9082

Drupal Core SQL Injection Vulnerability

CVE-2026-24425

Twig sandbox bypass vulnerability

CVE-2026-47114

IINA user-assisted command execution vulnerability

CVE-2026-47101

LiteLLM API key creation with unauthorized access

CVE-2025-34291

Langflow Langflow - Langflow Origin Validation Error Vulnerability

CVE-2026-34926

Trend Micro Apex One - Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability

CVE-2026-7498

Cross-site scripting vulnerability in Basamak Information Technology Consulting and Or

CVE-2026-6456

Privilege Escalation in WordPress Account Switcher plugin

CVE-2026-7467

Privilege Escalation in WordPress Read More & Accordion plugin

CVE-2026-7522

Local File Inclusion in WordPress Advanced Database Cleaner – Premium plugin

CVE-2026-5200

Missing Authorization in WordPress AcyMailing plugin

CVE-2026-45495

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

CVE-2026-8775

Edimax BR-6428NS formL2TPSetup Function Vulnerability

CVE-2026-8776

Edimax BR-6428NS formPPTPSetup Function Vulnerability

CVE-2026-7498

Basamak Information Technology Consulting and Or Cross-Site Scripting Vulnerability

CVE-2018-25322

Allok Fast AVI MPEG Splitter Stack-Based Buffer Overflow

CVE-2020-37227

HS Brand Logo Slider 2.1 Unrestricted File Upload

CVE-2021-47976

TextPattern CMS 4.9.0-dev Remote Code Execution

CVE-2021-47979

WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion

CVE-2026-8719

AI Engine WordPress Plugin Privilege Escalation

CVE-2018-25322

Allok Fast AVI MPEG Splitter 1.2 Stack-Based Buffer Overflow

CVE-2026-6228

WordPress Frontend Admin Plugin Privilege Escalation

CVE-2021-47964

Schlix CMS Remote Code Execution

CVE-2020-37227

HS Brand Logo Slider Unrestricted File Upload

CVE-2021-47976

TextPattern CMS Remote Code Execution

CVE-2021-47979

WordPress Backup and Restore Plugin Arbitrary File Deletion

CVE-2026-42897

Microsoft Exchange Server Cross-Site Scripting Vulnerability

CVE-2026-3425

WordPress RTMKit Addons for Elementor Plugin Local File Inclusion

CVE-2026-32643

BIG-IP and BIG-IQ Systems Privilege Escalation via Certificate Manager Role

CVE-2026-32673

BIG-IP Scripted Monitors Privilege Escalation

CVE-2026-34176

BIG-IP Appliance Mode Remote Command Injection

CVE-2026-20182

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

CVE-2026-6001

Authorization bypass in ABIS Technology Ltd. Co. BAPSİS allows exploitation of trusted identifiers.

CVE-2026-2465

Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-

CVE-2026-30810

Server-Side Request Forgery in Pandora FMS allows Privilege Escalation via API Checker extension.

CVE-2026-31222

Insecure deserialization vulnerability in snorkel library Trainer.load() method.

CVE-2026-31223

Critical insecure deserialization vulnerability in snorkel library BaseLabeler.load() method.

CVE-2026-40636

Dell ECS and ObjectScale Hard-Coded Credentials Vulnerability

CVE-2026-45006

OpenClaw Improper Access Control in Gateway Tool

CVE-2026-7256

Zyxel WRE6505 Command Injection Vulnerability

CVE-2026-6001

ABIS Technology BAPSİS Authorization Bypass

CVE-2026-34963

barebox EFI PE Loader Memory-Safety Vulnerabilities

CVE-2021-47935

Sentry 8.2.0 Remote Code Execution

CVE-2021-47937

e107 CMS 2.3.0 Remote Code Execution

CVE-2021-47938

ImpressCMS 1.4.2 Remote Code Execution

CVE-2021-47939

Evolution CMS 3.1.6 Remote Code Execution

CVE-2021-47943

TextPattern CMS 4.8.7 Remote Code Execution

CVE-2026-8234

EFM ipTIME A8004T 14.18.2 Vulnerability in formWifiBasicSet

CVE-2021-47935

Sentry 8.2.0 Remote Code Execution Vulnerability

CVE-2021-47937

e107 CMS 2.3.0 Remote Code Execution Vulnerability

CVE-2021-47938

ImpressCMS 1.4.2 Remote Code Execution Vulnerability

CVE-2021-47939

Evolution CMS 3.1.6 Remote Code Execution Vulnerability

CVE-2026-5127

WordPress User Frontend Plugin Deserialization Vulnerability

CVE-2026-39816

Apache NiFi Missing Restricted Annotation in TinkerpopClientService

CVE-2026-8234

EFM ipTIME A8004T formWifiBasicSet Security Vulnerability

CVE-2022-50994

DrayTek Vigor 2960 OS Command Injection

CVE-2026-7807

SmarterTools SmarterMail Local File Inclusion

CVE-2026-42208

BerriAI LiteLLM - SQL Injection Vulnerability

CVE-2026-20034

Cisco Unity Connection Web-based Management Interface Arbitrary Code Execution

CVE-2026-41934

Vvveb Authenticated Remote Code Execution in Admin Code Editor

CVE-2026-7927

Google Chrome Type Confusion in Runtime Arbitrary Code Execution

CVE-2026-43584

OpenClaw Insufficient Environment Variable Denylist Vulnerability

CVE-2026-6973

Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

CVE-2023-54345

Frappe Framework ERPNext Sandbox Escape Vulnerability

CVE-2023-54348

ERPGo SaaS CSV Injection Vulnerability

CVE-2026-42434

OpenClaw Sandbox Escape Vulnerability

CVE-2026-42435

OpenClaw Insufficient Shell-Wrapper Detection Vulnerability

CVE-2026-0300

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

CVE-2026-2052

Remote Code Execution in Widget Options WordPress Plugin

CVE-2026-7607

Firmware Update Vulnerability in TRENDnet TEW-821DAP

CVE-2026-7489

SQL Injection in Sunnet CTMS

CVE-2026-7674

Remote Code Execution in Shenzhen Libituo Technology LBT-T300-HW1

CVE-2026-7675

Remote Code Execution in Shenzhen Libituo Technology LBT-T300-HW1

CVE-2026-2052

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Executio

CVE-2026-7489

CTMS developed by Sunnet has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify,

CVE-2026-7641

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the

CVE-2026-7607

A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function auto_update_firmware of the component Firmware Udp

CVE-2026-7598

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c.

CVE-2026-6389

IBM Turbonomic prometurbo agent - Excessive Cluster-Wide Permissions

CVE-2026-6543

IBM Langflow Desktop - Arbitrary Command Execution

CVE-2026-7551

HKUDS OpenHarness - Remote Code Execution via /bridge Slash Command

CVE-2026-40912

Traefik - High Severity Authentication Bypass

CVE-2026-31431

Linux Kernel - Incorrect Resource Transfer Between Spheres Vulnerability

CVE-2026-34965

Cockpit CMS - Authenticated remote code execution vulnerability

CVE-2026-7466

AgentFlow - Arbitrary code execution vulnerability

CVE-2018-25308

BuddyPress Xprofile Custom Fields Type - Remote code execution vulnerability

CVE-2026-6849

TUBITAK BILGEM Software Technologies Research Institute Pardus - OS command injection vulnerability

CVE-2026-41940

WebPros cPanel & WHM and WP2 (WordPress Squared) - Missing Authentication for Critical Function

CVE-2026-41404

OpenClaw incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privileges

CVE-2026-42422

OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles.

CVE-2026-41378

OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests.

CVE-2026-7288

A vulnerability has been found in D-Link DIR-825M 1.1.12 affecting the function sub_4151FC of the file /boafrm/formVpnConfigSetup.

CVE-2026-7289

A vulnerability was found in D-Link DIR-825M 1.1.12 affecting the function sub_414BA8 of the file /boafrm/formWanConfigSetup.

CVE-2026-6741

LatePoint WordPress Plugin Privilege Escalation Vulnerability

CVE-2026-41463

ProjeQtor ZipSlip Path Traversal Vulnerability

CVE-2026-7096

Tenda HG3 2.0 formgponConf Function Vulnerability

CVE-2024-1708

ConnectWise ScreenConnect Path Traversal Vulnerability

CVE-2026-32202

Microsoft Windows Protection Mechanism Failure Vulnerability

CVE-2026-7068

D-Link DIR-825 Router NMBD_process Remote Code Execution

CVE-2026-7029

Tenda F456 Router addressNat Function Weakness

CVE-2026-7034

Tenda FH1202 Router WrlExtraSet Function Vulnerability

CVE-2026-7053

Tenda F456 Router HTTP Daemon L7Prot Flaw

CVE-2026-7057

Tenda F456 Router HTTP Daemon setcfm Unknown Flaw

CVE-2026-6988

Tenda HG10 Router Remote Code Execution

CVE-2026-7019

Tenda F456 Router P2pListFilter Vulnerability

CVE-2026-7029

Tenda F456 Router Address NAT Bypass

CVE-2026-7030

Tenda F456 Router Static Route Manipulation

CVE-2026-7031

Tenda F456 Router SafeMacFilter Bypass

CVE-2026-6988

A flaw has been found in Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon. This issue affects the function formRoute of the file /boaform/formRouting of th

CVE-2026-7019

A vulnerability was identified in Tenda F456 1.0.0.5. The impacted element is the function fromP2pListFilter of the file /goform/P2pListFilter. The ma

CVE-2026-6977

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask AP

CVE-2026-6980

A vulnerability has been found in Divyanshu-hash GitPilot-MCP up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd. This impacts the function repo_path of t

CVE-2026-6987

A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher M

CVE-2025-29635

D-Link DIR-823X Command Injection Vulnerability

CVE-2024-7399

Samsung MagicINFO 9 Server Path Traversal Vulnerability

CVE-2024-57728

SimpleHelp Path Traversal Vulnerability

CVE-2024-57726

SimpleHelp Missing Authorization Vulnerability

N/A-0000-0000

No Further Top Critical Vulnerabilities Identified

CVE-2026-6859

InstructLab Remote Code Execution via Hardcoded Trust

CVE-2026-41349

OpenClaw Agentic Consent Bypass Vulnerability

CVE-2026-41468

Beghelli Sicuro24 AngularJS Sandbox Escape Vulnerability

CVE-2026-34413

Xerte Online Toolkits Missing Authentication Vulnerability

CVE-2026-39987

Marimo Remote Code Execution Vulnerability

CVE-2026-6859

InstructLab - Remote Code Execution via Hardcoded Trust

CVE-2026-41468

Beghelli Sicuro24 SicuroWeb - AngularJS Sandbox Escape leading to RCE

CVE-2026-34413

Xerte Online Toolkits - Missing Authentication in elFinder Connector

CVE-2026-41455

WeKan - Server-Side Request Forgery via Webhook Integration

CVE-2026-33825

Microsoft Defender - Insufficient Granularity of Access Control Vulnerability

CVE-2026-6249

Vvveb CMS Remote Code Execution via Media Upload

CVE-2026-5967

ThreatSonar Anti-Ransomware Privilege Escalation

CVE-2026-34427

Vvveb Admin User Profile Privilege Escalation

CVE-2026-41445

KissFFT Integer Overflow in kiss_fftndr_alloc()

CVE-2026-34291

Oracle HTTP Server Core Vulnerability

CVE-2026-20122

Cisco Catalyst SD-WAN Manger - Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

CVE-2026-20133

Cisco Catalyst SD-WAN Manager - Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

CVE-2025-2749

Kentico Kentico Xperience - Kentico Xperience Path Traversal Vulnerability

CVE-2023-27351

PaperCut NG/MF - PaperCut NG/MF Improper Authentication Vulnerability

CVE-2025-48700

Synacor Zimbra Collaboration Suite (ZCS) - Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

CVE-2026-6518

CMP – Coming Soon & Maintenance Plugin for WordPress: Arbitrary File Upload and Remote Code Execution

CVE-2026-3464

WP Customer Area plugin for WordPress: Arbitrary File Read and Deletion

CVE-2026-40516

OpenHarness: Server-Side Request Forgery (SSRF)

CVE-2026-40527

radare2: Command Injection via Crafted ELF Binaries

CVE-2026-6507

dnsmasq: Out-of-Bounds Write via Specially Crafted BOOTREPLY

CVE-2026-6518

CMP – Coming Soon & Maintenance Plugin for WordPress: Arbitrary File Upload and RCE

CVE-2026-1620

Livemesh Addons for Elementor plugin for WordPress: Local File Inclusion

CVE-2025-14868

Career Section plugin for WordPress: CSRF leading to Path Traversal and Arbitrary File Deletion

CVE-2026-3464

WP Customer Area plugin for WordPress: Arbitrary File Read and Deletion

CVE-2026-6507

dnsmasq: Remote Out-of-bounds Write via BOOTREPLY

CVE-2026-40502

OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive a

CVE-2026-6348

WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing authenticated local attackers to execute arbitrar

CVE-2023-3634

In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which co

CVE-2026-5617

The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the handle_re

CVE-2026-34197

Apache ActiveMQ - Apache ActiveMQ Improper Input Validation Vulnerability

CVE-2026-25654

Siemens SINEC NMS Authorization Bypass

CVE-2026-27668

Siemens RUGGEDCOM CROSSBOW SAM-P Privilege Escalation

CVE-2026-40040

Pachno Unrestricted File Upload Vulnerability

CVE-2009-0238

Microsoft Office Remote Code Execution

CVE-2026-32201

Microsoft SharePoint Server Improper Input Validation

CVE-2025-60710

Microsoft Windows - Microsoft Windows Link Following Vulnerability

CVE-2023-36424

Microsoft Windows - Microsoft Windows Out-of-Bounds Read Vulnerability

CVE-2023-21529

Microsoft Exchange Server - Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

CVE-2026-21643

Fortinet FortiClient EMS - Fortinet SQL Injection Vulnerability

CVE-2026-34621

Adobe Acrobat and Reader - Adobe Acrobat and Reader Prototype Pollution Vulnerability

CVE-2026-6120

Tenda F451 Router fromDhcpListClient Vulnerability

CVE-2026-6121

Tenda F451 Router WrlclientSet Vulnerability

CVE-2026-6122

Tenda F451 Router L7 Protocol Form Vulnerability

CVE-2026-6123

Tenda F451 Router Address NAT Vulnerability

CVE-2026-6124

Tenda F451 Router Safe MAC Filter Vulnerability

CVE-2026-5144

BuddyPress Groupblog plugin for WordPress Privilege Escalation

CVE-2026-35643

OpenClaw Unvalidated WebView JavascriptInterface Arbitrary Instruction Injection

CVE-2026-6120

Tenda F451 Router Remote Code Execution Vulnerability

CVE-2026-35663

OpenClaw Privilege Escalation for Non-Admin Operators

CVE-2026-34621

Adobe Acrobat Reader Improperly Controlled Modification of Object Prototype Attributes

CVE-2026-35638

OpenClaw Control UI Unauthenticated Privilege Escalation

CVE-2026-39911

Hashgraph Guardian Unsandboxed JavaScript Execution

CVE-2026-33785

Juniper Junos OS MX Series Missing Authorization Privilege Escalation

CVE-2025-13914

Juniper Apstra SSH Key Exchange Without Entity Authentication

CVE-2023-54359

WordPress adivaha Travel Plugin Time-Based Blind SQL Injection

CVE-2026-3243

WordPress Advanced Members for ACF Plugin Arbitrary File Deletion

CVE-2026-4326

WordPress Vertex Addons for Elementor Plugin Missing Authorization

CVE-2026-5815

D-Link DIR-645 Router Remote Code Execution Vulnerability

CVE-2026-5830

Tenda AC15 Router Remote Code Execution Vulnerability

CVE-2026-5436

WordPress MW WP Form Plugin Arbitrary File Move/Read