Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,054 alerts · page 5 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-121353 Adobe Connect | Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploi...

  2. Critical (CVSS 9+) Published

    CVE-2026-121904 Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page contai...

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-121902 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially compromisi...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-121354 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-121892 Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploita...

  6. Critical (CVSS 9+) Published

    CVE-2026-89324 Basel Post Types <= 1.18 - Unauthenticated Authentication Bypass via Forged Opauth Callback Signature with Hardcoded Fallback Salt

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Xtemos Basel Post Types, wordpress basel-post-types

    The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to eva...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-125883 Multiple XXE Vulnerabilities

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: N-able N-central

    Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1.

  9. Critical (CVSS 9+) Published

    CVE-2026-126082 Active Storage: Possible arbitrary file write and read in Active Storage image analysis

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: rails

    Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, a Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary f...

  10. Critical (CVSS 9+) Published

    CVE-2026-118383 Pre-authentication use-after-free in MongoDB Server replica set primary catch-up

    CriticalCVSS 9.5

    Exploit status: No public exploit known

    Affects: MongoDB Server

    A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certa...

  11. Critical (CVSS 9+) Published

    CVE-2026-126065 OpenObserve: Empty external password allows authentication bypass

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: openobserve

    OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose password_ext value is missing or empty. SSO-provisioned a...

  12. Critical (CVSS 9+) Published

    CVE-2026-121529 A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, Fo...

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: fortinet forticlientmac, fortinet forticlientwindows, fortinet forticlientwindowspam

    A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an unauthorized remote attacker to execute...

  13. Critical (CVSS 9+) Published

    CVE-2026-121370 Security Advisory 0224

    CriticalCVSS 9.2

    Exploit status: No public exploit known

    Affects: Arista Networks EOS

    On affected platforms running Arista EOS with Precision Time Protocol (PTP) configured, an unauthenticated attacker with network access to a PTP-enabled port can create a denial of service (DoS) condition by sending traffic to the system.

  14. Critical (CVSS 9+) Published

    CVE-2026-121295 Security Advisory 0223

    CriticalCVSS 9.2

    Exploit status: No public exploit known

    Affects: Arista Networks EOS

    On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device reboot.

  15. Critical (CVSS 9+) Published

    CVE-2026-121289 Security Advisory 0208

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: Arista Networks EOS

    On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash. Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption t...

  16. Critical (CVSS 9+) Published

    CVE-2026-102166 Security Advisory 0227

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: Arista Networks Wi-Fi Access Point

    Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulner...

  17. Critical (CVSS 9+) Published

    CVE-2026-120808 Certificate Validation Bypass via IPv6 trust-result skip in macOS TLS client

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: MongoDB Server

    An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target, the trust evaluati...

  18. Critical (CVSS 9+) Published

    CVE-2026-126087 Untrusted search path in the cross-user process launcher in OpenJD Sessions for Python, as used in the AWS Deadline Cloud worker agent

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: AWS openjd-sessions, AWS deadline-cloud-worker-agent

    Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to submit jobs to a queue t...

  19. Critical (CVSS 9+) Published

    CVE-2026-125331 HarnessRouter: Service-only routes that write an organization's provider connections could be reached through a multi-tenant console with a made-up bearer

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: harnessrouter

    HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header b...

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-120002 Microsoft SharePoint Server Elevation of Privilege Vulnerability

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Microsoft sharepoint server, Microsoft SharePoint Server Subscription Edition

    Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).