Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,055 alerts · page 29 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-120308 Beta9 host filesystem exposure via volume path traversal

    CriticalCVSS 9.9 EPSS 0.53%

    Exploit status: No public exploit known

    Affects: beam-cloud Beta9 gateway, beam-cloud Beta9 worker

    A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume...

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-120307 Beta9 container escape via unvalidated sandbox file paths

    CriticalCVSS 9.9 EPSS 0.48%

    Exploit status: No public exploit known

    Affects: beam-cloud Beta9 worker

    The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is...

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-120306 Beta9 build sandbox escape via chroot-only isolation

    CriticalCVSS 9.9 EPSS 0.36%

    Exploit status: No public exploit known

    Affects: beam-cloud Beta9 worker

    Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-120227 WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection

    CriticalCVSS 9.4 EPSS 2.2%

    Exploit status: No public exploit known

    Affects: wavlink wn701ae firmware

    A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-120225 Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal

    CriticalCVSS 9.4 EPSS 0.73%

    Exploit status: No public exploit known

    Affects: oray pugongying x5 pro

    A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely...

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-120224 Oray Pugongying X5 Pro API Authorization run_async_task improper authorization

    CriticalCVSS 9.4 EPSS 0.38%

    Exploit status: No public exploit known

    Affects: oray pugongying x5 pro

    A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been re...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-117685 Gitea public-only package token access to private OCI blobs

    CriticalCVSS 9.1 EPSS 0.28%

    Exploit status: No public exploit known

    Affects: Gitea

    The OCI registry's cross-repository blob mount checked the target package against the token's public-only restriction, but checked the source blob only against the full account permissions of the token owner. A public-only token with write:package scope, whose owner can read a pr...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-116289 Gitea public-only token bypass through Actions runner registration

    CriticalCVSS 9.1 EPSS 0.28%

    Exploit status: No public exploit known

    Affects: Gitea

    Gitea did not reject personal access tokens restricted to public resources (public-only) on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write...

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-120263 Gitea OAuth2 account auto-linking takeover through the sign-up form

    CriticalCVSS 9.8 EPSS 0.34%

    Exploit status: No public exploit known

    Affects: Gitea

    When [oauth2_client].ACCOUNT_LINKING is set to auto (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An atta...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-120198 WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection

    CriticalCVSS 10.0 EPSS 2.1%

    Exploit status: No public exploit known

    Affects: wavlink WL-WN530BE1-A

    A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit ha...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-120197 WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection

    CriticalCVSS 9.4 EPSS 1.7%

    Exploit status: No public exploit known

    Affects: wavlink wl-wn530hg4b

    A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and ma...

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-120196 WAVLINK WN579X3-D wapi.cgi port_forward os command injection

    CriticalCVSS 9.4 EPSS 1.7%

    Exploit status: No public exploit known

    Affects: wavlink wn579x3-d

    A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be us...

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-120195 WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection

    CriticalCVSS 10.0 EPSS 2.1%

    Exploit status: No public exploit known

    Affects: wavlink wl-wn579a3-a

    A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to os command injection....

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-120189 D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow

    CriticalCVSS 10.0 EPSS 1.3%

    Exploit status: No public exploit known

    Affects: d-link dir-505

    A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-115946 XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder

    CriticalCVSS 9.8 EPSS 0.59%

    Exploit status: No public exploit known

    Affects: cpan XS-libbrotli

    XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundl...

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-118636 Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

    CriticalCVSS 9.8 EPSS 0.58%

    Exploit status: No public exploit known

    Affects: org.apache.mina/mina-core, ubuntu/mina, ubuntu/mina2 and 2 more

    UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we...

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-120209 AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

    CriticalCVSS 9.3 EPSS 0.54%

    Exploit status: No public exploit known

    Affects: anji-plus AJ-Report

    AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticate...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-120201 Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

    CriticalCVSS 9.3 EPSS 2.1%

    Exploit status: No public exploit known

    Affects: org.dromara.jpom/server, dromara Jpom

    Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condit...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-78191 WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages

    CriticalCVSS 9.8 EPSS 0.47%

    Exploit status: No public exploit known

    Affects: cpan WebDyne

    WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application that accepts uploads by...

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-78189 WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback

    CriticalCVSS 9.8 EPSS 0.61%

    Exploit status: No public exploit known

    Affects: cpan WebDyne

    WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. segments in the reques...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).