Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,055 alerts · page 26 of 53

  1. Critical (CVSS 9+) Published

    CVE-2026-121022 Default Administrator Password Change Not Enforced in Axxon One Web Client

    CriticalCVSS 9.2 EPSS 0.38%

    Exploit status: No public exploit known

    Affects: AxxonSoft Axxon One

    Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not...

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-92610 Improper limitation of paths in py-aspect-model-loader

    CriticalCVSS 9.8 EPSS 0.40%

    Exploit status: No public exploit known

    Affects: Eclipse Foundation Eclipse Semantic Modeling Framework (ESMF)

    In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A mode...

  3. Critical (CVSS 9+) Published

    CVE-2026-4052 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

    CriticalCVSS 9.8 EPSS 0.36%

    Exploit status: No public exploit known

    Affects: WSO2 API Manager, WSO2 API Control Plane, WSO2 Identity Server Key Manager Connector (apim-km-wso2is)

    This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Serve...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-13594 Improper Access Control vulnerability

    CriticalCVSS 9.1 EPSS 1.1%

    Exploit status: No public exploit known

    Affects: Zohocorp Log360, Zohocorp EventLog Analyzer

    Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.

  5. Critical (CVSS 9+) Published

    CVE-2026-120534 Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type

    CriticalCVSS 9.8 EPSS 0.31%

    Exploit status: No public exploit known

    Affects: ACF Extended Advanced Custom Fields: Extended PRO, wordpress acf-extended-pro

    The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field set...

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-120518 BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler

    CriticalCVSS 9.1 EPSS 0.78%

    Exploit status: No public exploit known

    Affects: wordpress buddypress-xprofile-image-field, kalengi BuddyPress XProfile Custom Image Field

    The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with n...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-38595 An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint.

    CriticalCVSS 9.8 EPSS 0.48%

    Exploit status: No public exploit known

    An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint.

  8. Critical (CVSS 9+) Published

    CVE-2026-38600 A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.

    CriticalCVSS 9.8 EPSS 0.64%

    Exploit status: No public exploit known

    A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-86596 s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

    CriticalCVSS 9.8 EPSS 1.5%

    Exploit status: No public exploit known

    Affects: clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions, wordpress s2member

    The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-116769 Authentication bypass in Secure Access Servers

    CriticalCVSS 9.3 EPSS 0.41%

    Exploit status: No public exploit known

    Affects: Absolute Security Secure Access

    CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-97718 CSRF in Secure Access Server v14.60

    CriticalCVSS 9.4 EPSS 0.19%

    Exploit status: No public exploit known

    Affects: Absolute Security Secure Access

    CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-58968 In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no additional execution privileges needed. User....

    CriticalCVSS 9.8 EPSS 0.29%

    Exploit status: No public exploit known

    Affects: Google Android

    In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-58936 In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is...

    CriticalCVSS 9.8 EPSS 0.31%

    Exploit status: No public exploit known

    Affects: Google Android

    In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-58876 In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not...

    CriticalCVSS 9.8 EPSS 0.31%

    Exploit status: No public exploit known

    Affects: Google Android

    In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-58868 In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed....

    CriticalCVSS 9.8 EPSS 0.39%

    Exploit status: No public exploit known

    Affects: Google Android

    In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-102435 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

    CriticalCVSS 9.8 EPSS 0.59%

    Exploit status: No public exploit known

    Affects: themefic Ultra Addons for Contact Form 7, wordpress ultimate-addons-for-contact-form-7

    The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbi...

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8

    CriticalCVSS 9.5 EPSS 0.36%

    Exploit status: No public exploit known

    Affects: joomlaboat.com Custom Tables extension for Joomla

    Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Ta...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-105604 Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3

    CriticalCVSS 9.3 EPSS 0.35%

    Exploit status: No public exploit known

    Affects: dj-extensions.com DJ-Classifieds extension for Joomla

    Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-105603 Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3

    CriticalCVSS 9.4 EPSS 0.30%

    Exploit status: No public exploit known

    Affects: dj-extensions.com DJ-Classifieds extension for Joomla

    Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE.

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-119085 Template injection in the publishing component of awslabs Virtual Engineering Workbench

    CriticalCVSS 9.4 EPSS 0.55%

    Exploit status: No public exploit known

    Affects: AWS virtual-engineering-workbench

    Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This coul...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).