Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,054 alerts · page 17 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-113615 GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi

    CriticalCVSS 9.8 EPSS 0.53%

    Exploit status: No public exploit known

    Affects: wordpress gs-jwt-auth-and-otp-varification

    The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrato...

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-116533 Static Snapshot <= 0.2.1 - Unauthenticated RCE via 'name' Parameter

    CriticalCVSS 9.8 EPSS 0.53%

    Exploit status: No public exploit known

    Affects: wordpress static-snapshot

    The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-115230 WHIZZ <= 1.1.8 - Unauthenticated Arbitrary User Password Reset

    CriticalCVSS 9.8 EPSS 0.42%

    Exploit status: No public exploit known

    Affects: wordpress whizz

    The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fu...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-113584 Real Estate Website Builder <= 1.4.3 - Unauthenticated Account Takeover via User Email Update

    CriticalCVSS 9.8 EPSS 0.43%

    Exploit status: No public exploit known

    Affects: wordpress placester

    The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-110955 Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass

    CriticalCVSS 9.8 EPSS 0.34%

    Exploit status: No public exploit known

    Affects: wordpress wurdey

    The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-63774 Subnet Solutions PowerSYSTEM Center SQL Injection

    CriticalCVSS 9.4 EPSS 0.30%

    Exploit status: No public exploit known

    Affects: Subnet Solutions PowerSYSTEM Center 2024, Subnet Solutions PowerSYSTEM Center 2026

    Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-63017 Subnet Solutions PowerSYSTEM Center Incorrect Authorization

    CriticalCVSS 9.4 EPSS 0.27%

    Exploit status: No public exploit known

    Affects: Subnet Solutions PowerSYSTEM Center 2020, Subnet Solutions PowerSYSTEM Center 2024, Subnet Solutions PowerSYSTEM Center 2026

    Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-77596 Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

    CriticalCVSS 9.6 EPSS 0.25%

    Exploit status: No public exploit known

    Affects: kubeflow pipelines

    Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns wi...

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-111494 Incorrect validation of TLS certificates in the MatchPoint Android app

    CriticalCVSS 9.1 EPSS 0.16%

    Exploit status: No public exploit known

    Affects: TPC Software Matchpoint

    Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could rea...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-111490 Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

    CriticalCVSS 9.9 EPSS 0.38%

    Exploit status: No public exploit known

    Affects: TPC Software Matchpoint

    Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financi...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-111489 A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

    CriticalCVSS 9.9 EPSS 0.30%

    Exploit status: No public exploit known

    Affects: TPC Software Matchpoint

    A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

  12. Critical (CVSS 9+) Published

    CVE-2026-119757 BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

    CriticalCVSS 9.3 EPSS 0.54%

    Exploit status: No public exploit known

    Affects: btcpayserver/btcpayserver

    BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon...

  13. Critical (CVSS 9+) Published

    CVE-2026-48705 MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

    CriticalCVSS 9.3 EPSS 0.51%

    Exploit status: No public exploit known

    Affects: Project-MONAI MONAI, pypi monai

    MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without v...

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-85076 Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)

    CriticalCVSS 9.0 EPSS 0.40%

    Exploit status: No public exploit known

    Affects: jhuckaby Cronicle

    Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-46350 dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

    CriticalCVSS 9.1 EPSS 0.60%

    Exploit status: No public exploit known

    Affects: dcmjs-org dcmjs, npm dcmjs

    dcmjs is a JavaScript implementation of DICOM manipulation. Prior to 0.52.0, the DecimalString and IntegerString implementations in src/ValueRepresentation.js sanitize text with a permissive regular expression and pass the result to JavaScript's Number constructor without validat...

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-102940 OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment

    CriticalCVSS 9.6 EPSS 0.38%

    Exploit status: No public exploit known

    Affects: openemr, open-emr openemr

    OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and...

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-116790 FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY

    CriticalCVSS 9.1 EPSS 0.34%

    Exploit status: No public exploit known

    Affects: signalwire freeswitch, freeswitch

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryp...

  18. CISA KEV addition Critical (CVSS 9+) Published · updated

    CVE-2026-116779 FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

    CriticalCVSS 9.8 EPSS 2.5% CISA KEV added 2026-11-09 · due 2026-11-12 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: signalwire freeswitch, freeswitch

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAG...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-116785 FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling

    CriticalCVSS 9.1 EPSS 1.1%

    Exploit status: No public exploit known

    Affects: signalwire freeswitch, freeswitch

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() decoded a WebSocket frame's 64-bit extended payload length with...

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-100358 SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

    CriticalCVSS 9.4 EPSS 0.43%

    Exploit status: No public exploit known

    Affects: SuiteCRM

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).