Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,054 alerts · page 9 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-76964 Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)

    CriticalCVSS 10.0 EPSS 0.43%

    Exploit status: No public exploit known

    Affects: SAP_SE SAP NetWeaver AS ABAP (Internet Communication Manager)

    SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successf...

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-125383 INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass

    CriticalCVSS 9.3 EPSS 0.83%

    Exploit status: No public exploit known

    Affects: go2ismail Asp.Net-Core-Inventory-Order-Management-System

    INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID a...

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-125384 INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeeder

    CriticalCVSS 9.3 EPSS 0.48%

    Exploit status: No public exploit known

    Affects: go2ismail Asp.Net-Core-Inventory-Order-Management-System

    INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates admin@root.com with password 123456. Attackers can log in with these credentials, which carry every a...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-125370 Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret

    CriticalCVSS 9.3 EPSS 0.68%

    Exploit status: No public exploit known

    Affects: kubero-dev kubero

    Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups an...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-115934 SQL injection leading to privilege escalation

    CriticalCVSS 9.3 EPSS 0.48%

    Exploit status: No public exploit known

    Affects: craftcms cms

    An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator. Note that this only affects MySQL/MariaDB. Impact * SQL injection — The attribute para...

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-125120 Mongoose: sanitizeFilter not applied on countDocuments

    CriticalCVSS 9.8 EPSS 0.57%

    Exploit status: No public exploit known

    Affects: automattic mongoose, npm mongoose

    Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFi...

  7. Critical (CVSS 9+) Published

    CVE-2026-123815 pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

    CriticalCVSS 9.4 EPSS 0.37%

    Exploit status: No public exploit known

    Affects: pyload, pypi pyload-ng

    pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-123807 Signal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and remote code execution

    CriticalCVSS 9.8 EPSS 0.54%

    Exploit status: No public exploit known

    Affects: signalk-server, SignalK resources-provider, npm signalk-server

    Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts an unsafe resour...

  9. Critical (CVSS 9+) Published

    CVE-2026-124001 ION-DTN 2.2.1b-4.2.0 Integer Overflow Heap Corruption via DGR

    CriticalCVSS 9.2 EPSS 0.52%

    Exploit status: No public exploit known

    Affects: nasa-jpl/ion-dtn

    NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size cal...

  10. Critical (CVSS 9+) Published

    CVE-2026-123800 SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications

    CriticalCVSS 9.9 EPSS 0.59%

    Exploit status: No public exploit known

    Affects: supertokens-core

    SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/ja...

  11. Critical (CVSS 9+) Published

    CVE-2026-123270 CVE-2026-123270

    CriticalCVSS 9.8 EPSS 0.64%

    Exploit status: No public exploit known

    Affects: Redpanda Data Connect

    Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (RCE). In streams mode, the management HTTP API is exposed on 0.0.0.0:4195, but authentication is disabled by default and there is no authenti...

  12. Critical (CVSS 9+) Published

    CVE-2026-119756 Tasmota 16.0.0 Heap Out-of-Bounds Write via Device Groups UDP

    CriticalCVSS 9.3 EPSS 0.49%

    Exploit status: No public exploit known

    Affects: arendst/tasmota

    Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 tha...

  13. Critical (CVSS 9+) Published

    CVE-2026-104989 Pre-authentication remote code execution in Chaos V-Ray Swarm

    CriticalCVSS 9.3 EPSS 0.60%

    Exploit status: No public exploit known

    Affects: Chaos Software V-Ray Swarm

    Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries

  14. Critical (CVSS 9+) Published

    CVE-2026-110469 Remote Code Execution via Unrestricted File Upload in WidzialniCMS

    CriticalCVSS 10.0 EPSS 0.70%

    Exploit status: No public exploit known

    Affects: Fundacja Widzialni WidzialniCMS

    WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the...

  15. Critical (CVSS 9+) Published

    CVE-2026-110468 Remote Code Execution via Unrestricted File Upload in WidzialniCMS

    CriticalCVSS 10.0 EPSS 0.64%

    Exploit status: No public exploit known

    Affects: Fundacja Widzialni WidzialniCMS

    WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any...

  16. Critical (CVSS 9+) Published

    CVE-2026-124079 rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 RCE via Unauthenticated Redis Queue Poisoning

    CriticalCVSS 9.3 EPSS 0.62%

    Exploit status: No public exploit known

    Affects: rconfig/rconfig, rConfig Pro

    rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that allows unauthenticated network attackers to execute arbitrary code by pushing a crafted serialized job onto the Redis-backed Laravel Horizon queue, which r...

  17. Critical (CVSS 9+) Published

    CVE-2026-118462 AIS update mechanism executes unverified code

    CriticalCVSS 9.2 EPSS 0.17%

    Exploit status: No public exploit known

    Affects: CompuGroup Medical Infantia, CompuGroup Medical Profim, CompuGroup Medical Venere and 1 more

    Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-115252 Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option

    CriticalCVSS 10.0 EPSS 0.42%

    Exploit status: No public exploit known

    Affects: wordpress confection

    The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary...

  19. Critical (CVSS 9+) Published

    CVE-2026-124585 Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injection

    CriticalCVSS 9.4 EPSS 2.2%

    Exploit status: No public exploit known

    Affects: chengdu feiyuxing technology vw2100, chengdu feiyuxing technology vec10gp

    A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os co...

  20. Critical (CVSS 9+) Published

    CVE-2026-123870 [Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when GITHUB_WEBHOOK_SECRET is unset

    CriticalCVSS 9.5 EPSS 0.30%

    Exploit status: No public exploit known

    Affects: pypi otterdog

    The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthe...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).