Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,052 alerts · page 49 of 53

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-78845 Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root descript...

    CriticalCVSS 9.8 EPSS 0.78%

    Exploit status: No public exploit known

    Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing.

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-116747 Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret

    CriticalCVSS 9.2 EPSS 2.1%

    Exploit status: No public exploit known

    Affects: rajnandan1 kener

    Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a k...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-116508 TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow

    CriticalCVSS 10.0 EPSS 0.61%

    Exploit status: No public exploit known

    Affects: totolink a950rg firmware

    A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffe...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-116506 TOTOLINK A950RG firewall.so apmib_set command injection

    CriticalCVSS 9.4 EPSS 1.9%

    Exploit status: No public exploit known

    Affects: totolink a950rg firmware

    A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-116505 TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection

    CriticalCVSS 9.4 EPSS 2.7%

    Exploit status: No public exploit known

    Affects: totolink a950rg firmware

    A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-112552 An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with control of a network...

    CriticalCVSS 9.8 EPSS 0.60%

    Exploit status: No public exploit known

    Affects: apple macos

    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with control of a network file server may be able to cause unexpected system termination.

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-84539 An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination.

    CriticalCVSS 9.8 EPSS 0.52%

    Exploit status: No public exploit known

    Affects: apple macos

    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination.

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-112514 A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS...

    CriticalCVSS 9.1 EPSS 0.68%

    Exploit status: No public exploit known

    Affects: apple iOS and iPadOS, apple macos, apple tvOS and 4 more

    A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker may be able t...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-112521 A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A sandboxed process may be able to circumvent sa...

    CriticalCVSS 9.3 EPSS 0.22%

    Exploit status: No public exploit known

    Affects: apple macos

    A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A sandboxed process may be able to circumvent sandbox restrictions.

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-112690 This issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2...

    CriticalCVSS 10.0 EPSS 0.99%

    Exploit status: No public exploit known

    Affects: apple iOS and iPadOS, apple macos, apple visionOS and 2 more

    This issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. A remote attacker may be able to break out of the WebContent sa...

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-84633 A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox.

    CriticalCVSS 9.0 EPSS 0.16%

    Exploit status: No public exploit known

    Affects: apple macos

    A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox.

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-112478 An out-of-bounds read issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination....

    CriticalCVSS 9.0 EPSS 0.18%

    Exploit status: No public exploit known

    Affects: apple macos

    An out-of-bounds read issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory.

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-112497 This issue was addressed with improved permissions checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox.

    CriticalCVSS 9.0 EPSS 0.20%

    Exploit status: No public exploit known

    Affects: apple macos

    This issue was addressed with improved permissions checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox.

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-112526 A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause unexpecte...

    CriticalCVSS 9.8 EPSS 0.85%

    Exploit status: No public exploit known

    Affects: apple macos

    A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause unexpected app termination.

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-112443 The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process m...

    CriticalCVSS 9.1 EPSS 0.55%

    Exploit status: No public exploit known

    Affects: apple macos

    The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-113897 This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break ou...

    CriticalCVSS 10.0 EPSS 0.78%

    Exploit status: No public exploit known

    Affects: apple Safari, apple iOS and iPadOS, apple macos and 3 more

    This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox.

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-116504 TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection

    CriticalCVSS 9.4 EPSS 1.5%

    Exploit status: No public exploit known

    Affects: totolink a950rg firmware

    A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be in...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-110720 Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules

    CriticalCVSS 9.9 EPSS 0.37%

    Exploit status: No public exploit known

    Affects: hashicorp Tooling

    Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-10757 BUG-000187511 - ArcGIS Server has a security vulnerability.

    CriticalCVSS 9.8 EPSS 0.45%

    Exploit status: No public exploit known

    Affects: esri ArcGIS Server

    There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).