Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,055 alerts · page 32 of 53

  1. Critical (CVSS 9+) Published

    CVE-2026-61730 SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount

    CriticalCVSS 9.3 EPSS 0.37%

    Exploit status: No public exploit known

    Affects: socfortress CoPilot

    SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated /scoutsuite-report StaticFiles mount in backend/copilot.py exposes the scoutsuite-report directory even though normal /api routes r...

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-61729 SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection

    CriticalCVSS 9.4 EPSS 0.38%

    Exploit status: No public exploit known

    Affects: socfortress CoPilot

    SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, verify_graylog_header in backend/app/active_response/routes/graylog.py and verify_velociraptor_header in backend/app/incidents/routes/incident_alert.py authent...

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-61728 SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover

    CriticalCVSS 9.9 EPSS 0.46%

    Exploit status: No public exploit known

    Affects: socfortress CoPilot

    SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including customer_user, can submit stored markup through POST /api/incidents/db_op...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-112905 Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft

    CriticalCVSS 9.0 EPSS 0.50%

    Exploit status: No public exploit known

    Affects: givanz/vvveb

    Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been...

  5. Critical (CVSS 9+) Published

    CVE-2026-110799 Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover

    CriticalCVSS 9.8 EPSS 0.71%

    Exploit status: No public exploit known

    Affects: givanz/vvveb

    Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This i...

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-119660 MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key

    CriticalCVSS 9.3 EPSS 0.52%

    Exploit status: No public exploit known

    Affects: yincongcyincong MuseBot

    MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full admin...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-119597 OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery

    CriticalCVSS 9.3 EPSS 0.37%

    Exploit status: No public exploit known

    Affects: AIDotNet OpenDeepWiki

    OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-118994 CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name

    CriticalCVSS 9.8 EPSS 0.45%

    Exploit status: No public exploit known

    Affects: cpan CallBackery

    CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text...

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-118995 CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator

    CriticalCVSS 9.1 EPSS 0.32%

    Exploit status: No public exploit known

    Affects: cpan CallBackery

    CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the pattern. An alternation such as yes|no then a...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-116127 Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection

    CriticalCVSS 9.1 EPSS 0.32%

    Exploit status: No public exploit known

    Affects: cpan Starlet, debian/starlet, ubuntu/starlet

    Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. Wit...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-116130 HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request

    CriticalCVSS 9.1 EPSS 0.59%

    Exploit status: No public exploit known

    Affects: cpan HTTP-Parser-XS, debian/libhttp-parser-xs-perl, ubuntu/libhttp-parser-xs-perl

    HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not aff...

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-119568 vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking

    CriticalCVSS 9.1 EPSS 0.40%

    Exploit status: No public exploit known

    Affects: vsftpd, azure linux vsftpd, debian/vsftpd and 1 more

    vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, the...

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-119419 CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation

    CriticalCVSS 9.2 EPSS 0.39%

    Exploit status: No public exploit known

    Affects: cakephp/cakephp, ubuntu/cakephp

    CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append...

  14. Critical (CVSS 9+) Published

    CVE-2026-119418 CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()

    CriticalCVSS 9.2 EPSS 0.48%

    Exploit status: No public exploit known

    Affects: cakephp/cakephp, ubuntu/cakephp

    CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-116366 Unauthenticated RCE vulnerability against ClickHouse Server

    CriticalCVSS 9.5 EPSS 0.96%

    Exploit status: No public exploit known

    Affects: ClickHouse, ClickHouse Cloud, debian/clickhouse and 1 more

    An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

  16. Critical (CVSS 9+) Published · updated

    CVE-2025-31704 Dahua Intelligent Connection Center command injection

    CriticalCVSS 9.8 EPSS 1.4%

    Exploit status: No public exploit known

    Affects: Dahua Intelligent Connection Center

    A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-64618 Apache Fineract: SQL injection vulnerability in Search API

    CriticalCVSS 9.8 EPSS 0.62%

    Exploit status: No public exploit known

    Affects: Apache Fineract, apache fineract

    Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP...

  18. Critical (CVSS 9+) Published

    CVE-2026-82104 API permission bypass via logic bug

    CriticalCVSS 9.4 EPSS 0.39%

    Exploit status: No public exploit known

    Affects: Teltonika Networks RUT, Teltonika Networks RUTX, Teltonika Networks RUTM and 11 more

    In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API r...

  19. Critical (CVSS 9+) Published

    CVE-2026-103039 Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

    CriticalCVSS 9.8 EPSS 0.51%

    Exploit status: No public exploit known

    Affects: Gravity Forms, wordpress gravityforms

    The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global mayb...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).