Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,054 alerts · page 3 of 53

  1. Critical (CVSS 9+) Published

    CVE-2026-123710 Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: redhat/quay/quay-rhel8, redhat/quay/quay-rhel9, redhat quay

    A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key...

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-119618 Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: debian/apache2, redhat/httpd, redhat/mod_http2 and 4 more

    Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 thr...

  3. Critical (CVSS 9+) Published

    CVE-2026-85632 Unauthenticated Payment Status Manipulation in Sipay Electronic Money's WordPress (WooCommerce)

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module

    Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Midd...

  4. Critical (CVSS 9+) Published

    CVE-2026-126537 Ninja Forms - File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: wordpress ninja-forms-uploads, SaturdayDrive Ninja Forms - File Uploads

    The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process() in includes/fields/upload.php —...

  6. Critical (CVSS 9+) Published

    CVE-2026-118965 Path traversal in host label synchronization allows code execution on the central site from a remote site

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: Checkmk GmbH Checkmk

    Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an attacker in control of a remote site in a distributed monitoring setup to write arbitrary files on the central site and thereby execute code as the central site u...

  7. Critical (CVSS 9+) Published

    CVE-2026-120495 Arbitrary file write and code execution via crafted Synthetic Monitoring agent data

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: Checkmk GmbH Checkmk

    Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location f...

  8. Critical (CVSS 9+) Published

    CVE-2026-121374 Arbitrary file write and code execution via excluded node roles in Kubernetes special agent

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: Checkmk GmbH Checkmk

    Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in the "Exclude nodes base...

  9. Critical (CVSS 9+) Published

    CVE-2026-112174 Privilege escalation in Enter’s Iperius Backup

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: Enter Iperius Backup

    Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator...

  10. Critical (CVSS 9+) Published

    CVE-2026-123695 Security For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token Disclosure

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators.

  11. Critical (CVSS 9+) Published

    CVE-2026-121497 Askany < 2.2.0 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are...

  12. Critical (CVSS 9+) Published

    CVE-2026-115735 Somatic Framework <= 1.8.14 - Subscriber+ Arbitrary File Deletion

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site ta...

  14. Critical (CVSS 9+) Published

    CVE-2026-115733 PrintAura WooCommerce API <= 4.0.2 - Unauthenticated WooCommerce REST API Authentication Bypass

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer...

  15. Critical (CVSS 9+) Published

    CVE-2026-64678 Nitrite: Unfiltered Java Deserialization in Legacy v1 Database Migration Path

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: nitrite-java

    NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate() automatically checks for a legacy v1-format store and, on detecting one (or hitting a compatibility e...

  16. Critical (CVSS 9+) Published

    CVE-2026-64682 AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: NauelG astro-blocks

    AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package)...

  17. Critical (CVSS 9+) Published

    CVE-2026-64670 Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: walinejs waline

    Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with t...

  18. Critical (CVSS 9+) Published

    CVE-2026-126542 WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: WWBN AVideo

    WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and wit...

  19. Critical (CVSS 9+) Published

    CVE-2026-126539 Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface

    CriticalCVSS 9.2

    Exploit status: No public exploit known

    Affects: npm directus

    Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountabilit...

  20. Critical (CVSS 9+) Published

    CVE-2026-126187 React: Unauthenticated Remote Code Execution in React Server Components

    CriticalCVSS 9.5

    Exploit status: No public exploit known

    Affects: react, npm react-server-dom-webpack, npm react-server-dom-turbopack and 1 more

    React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafte...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).