Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,055 alerts · page 27 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-120630 CVE-2026-120630

    CriticalCVSS 9.1 EPSS 0.29%

    Exploit status: No public exploit known

    Affects: CrewAI

    CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-105769 kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

    CriticalCVSS 9.3 EPSS 0.20%

    Exploit status: No public exploit known

    Affects: chainguard-dev github.com/chainguard-dev/kaniko

    kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a ho...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-16306 CVE-2026-16306

    CriticalCVSS 9.8 EPSS 0.68%

    Exploit status: No public exploit known

    Affects: INFINITT Healthcare System Manager

    Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-co...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-94290 Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller

    CriticalCVSS 9.1 EPSS 0.50%

    Exploit status: No public exploit known

    Affects: SUSE Rancher

    SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Flee...

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-120459 python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key

    CriticalCVSS 9.1 EPSS 0.25%

    Exploit status: No public exploit known

    Affects: pypi python-jose, debian/python-jose, ubuntu/python-jose

    python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-120447 HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code

    CriticalCVSS 9.2 EPSS 0.53%

    Exploit status: No public exploit known

    Affects: bufanyun HotGo

    HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a known code and sign in th...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-120442 ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass

    CriticalCVSS 9.3 EPSS 1.7%

    Exploit status: No public exploit known

    Affects: xianhc ape-volo-admin

    ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to the seeded administra...

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-111959 Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

    CriticalCVSS 9.1 EPSS 0.55%

    Exploit status: No public exploit known

    Affects: redhat/openshift-logging/vector-rhel9, crates.io arrow-data, crates.io arrow

    Out-of-bounds read vulnerability in Apache Arrow Rust (arrow crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values arra...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-114364 Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search

    CriticalCVSS 9.8 EPSS 0.45%

    Exploit status: No public exploit known

    Affects: org.apache.syncope.core/syncope-core-persistence-jpa

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leve...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-113687 Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass

    CriticalCVSS 9.8 EPSS 0.58%

    Exploit status: No public exploit known

    Affects: org.apache.syncope.core/syncope-core-spring

    Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox. This issue affe...

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-113511 Apache Syncope: Delegated administration boundaries can be bypassed for Realm update

    CriticalCVSS 9.1 EPSS 0.43%

    Exploit status: No public exploit known

    Affects: org.apache.syncope.core.idrepo/syncope-core-idrepo-logic

    Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16,...

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-109083 Apache Syncope: Remote Code Execution via Flowable JUEL expression

    CriticalCVSS 9.8 EPSS 0.52%

    Exploit status: No public exploit known

    Affects: org.apache.syncope.ext.flowable/syncope-ext-flowable-bpmn

    Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and star...

  14. CISA KEV addition Critical (CVSS 9+) Published · updated

    CVE-2026-116606 Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway

    CriticalCVSS 9.3 EPSS 8.9% CISA KEV added 2026-11-10 · due 2026-11-13 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: barracuda networks Barracuda Email Security Gateway (ESG), barracuda email security gateway 300 firmware, barracuda email security gateway 400 firmware and 3 more

    An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the applian...

  15. CISA KEV addition Published · updated

    CVE-2026-111560 OS Command Injection in Barracuda Appliances

    HighCVSS 8.6 EPSS 6.2% CISA KEV added 2026-11-10 · due 2026-11-13 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: barracuda networks Barracuda Email Security Gateway (ESG), barracuda networks Barracuda Load Balancer Application Delivery Controller (ADC), barracuda networks Barracuda Web Application Firewall (WAF) and 12 more

    Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is...

  16. Critical (CVSS 9+) Published

    CVE-2026-120213 @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

    CriticalCVSS 9.1 EPSS 0.69%

    Exploit status: No public exploit known

    Affects: redhat/rhoai/odh-core-bff-rhel9, redhat/rhoai/odh-dashboard-operator-rhel9, redhat/rhoai/odh-dashboard-rhel9 and 10 more

    @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substi...

  17. Critical (CVSS 9+) Published · updated

    CVE-2025-11969 Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions

    CriticalCVSS 9.4 EPSS 0.32%

    Exploit status: No public exploit known

    Affects: WSO2 API Manager, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM and 6 more

    The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could ena...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-120345 WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection

    CriticalCVSS 10.0 EPSS 2.0%

    Exploit status: No public exploit known

    Affects: wavlink wn551x3-a

    A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate...

  19. Critical (CVSS 9+) Published

    CVE-2026-120344 WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection

    CriticalCVSS 10.0 EPSS 2.0%

    Exploit status: No public exploit known

    Affects: wavlink wn551x3-a

    A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be perform...

  20. Critical (CVSS 9+) Published

    CVE-2026-120322 Termix-SSH Termix transferToHost path traversal

    CriticalCVSS 9.4 EPSS 0.62%

    Exploit status: No public exploit known

    Affects: Termix-SSH Termix

    A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).