CVE-2026-48056 | Critical | 10.0 | 2026-08-11 | Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplie… |
CVE-2026-68823 | Critical | 9.1 | 2026-08-07 | Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network. |
CVE-2026-18901 | High | 7.2 | 2026-08-05 | A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such mani… |
CVE-2026-20467 | Medium | 6.0 | 2026-08-03 | In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2026-44107 | High | 7.5 | 2026-07-30 | A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the… |
CVE-2026-45805 | High | 8.8 | 2026-07-15 | Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServe… |
CVE-2026-53633 | Critical | 9.8 | 2026-07-14 | Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chro… |
CVE-2025-53827 | Critical | 9.1 | 2026-07-06 | ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Up… |
CVE-2026-45489 | Medium | 6.5 | 2026-07-03 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2026-14620 | Medium | 4.7 | 2026-07-03 | webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that… |
CVE-2026-54753 | Medium | 5.9 | 2026-06-26 | Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Acc… |
CVE-2026-55454 | Critical | 9.9 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authenti… |
CVE-2026-48783 | Medium | 4.8 | 2026-06-17 | Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscript… |
CVE-2026-49993 | Medium | 5.7 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0… |
CVE-2026-45670 | Medium | 5.4 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alph… |
CVE-2026-12060 | Medium | 6.5 | 2026-06-12 | Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers to leverage social e… |
CVE-2026-7516 | Medium | 4.3 | 2026-06-10 | A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited… |
CVE-2026-47899 | | | 2026-06-09 | The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path validation. An attacker… |
CVE-2026-41283 | Critical | 9.9 | 2026-06-04 | OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead… |
CVE-2026-44698 | High | 8.3 | 2026-05-29 | Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home A… |
CVE-2026-44798 | High | 7.1 | 2026-05-28 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record could… |
CVE-2025-14713 | High | 7.5 | 2026-05-27 | An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain u… |
CVE-2026-44836 | Medium | 6.5 | 2026-05-26 | view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derive… |
CVE-2026-4051 | High | 7.2 | 2026-05-26 | IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an attacker with administrative privileges to execute remote code due to exposed metho… |
CVE-2026-33584 | Medium | 5.3 | 2026-05-13 | Exposed Keycloak management
service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug
information such as metrics… |
CVE-2026-33583 | High | 8.7 | 2026-05-13 | Exposure of the QKEY (used as
input into the ‘OTA-Quantum’ device registration process) and internal
system keys via an unauthenticated and unencrypted HTTP… |
CVE-2026-8108 | High | 7.8 | 2026-05-12 | The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions. |
CVE-2026-8109 | Medium | 6.5 | 2026-05-12 | An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credent… |
CVE-2026-6402 | Medium | 5.3 | 2026-05-12 | webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origi… |
CVE-2026-25266 | Medium | 5.5 | 2026-05-04 | Memory corruption while processing IOCTL command when device is in power-save state. |
CVE-2026-24118 | Critical | 9.8 | 2026-05-04 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code w… |
CVE-2026-5173 | High | 8.5 | 2026-04-08 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have a… |
CVE-2026-35488 | High | 8.1 | 2026-04-07 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewS… |
CVE-2026-2275 | Critical | 9.6 | 2026-03-30 | The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through arbitrary C function calling. |
CVE-2026-3483 | High | 7.8 | 2026-03-10 | An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges. |
CVE-2026-30957 | Critical | 9.9 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged authenticated projec… |
CVE-2026-30921 | Critical | 9.9 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.20, OneUptime Synthetic Monitors allow low-privileged project users to submi… |
CVE-2026-30797 | High | 8.1 | 2026-03-05 | Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, conf… |
CVE-2026-20423 | High | 7.8 | 2026-03-02 | In wlan STA driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution… |
CVE-2026-28400 | High | 7.5 | 2026-02-27 | Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST `/engines/_configure` en… |
CVE-2026-22208 | Critical | 9.6 | 2026-02-17 | OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter… |
CVE-2025-47366 | High | 7.1 | 2026-02-02 | Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input. |
CVE-2026-22812 | High | 8.8 | 2026-01-12 | OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or an… |
CVE-2025-9611 | | | 2026-01-07 | Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS… |
CVE-2025-68697 | High | 7.1 | 2025-12-26 | n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy (non-task-runner) J… |
CVE-2025-14497 | High | 7.8 | 2025-12-23 | RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2025-14496 | High | 7.8 | 2025-12-23 | RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2025-14495 | High | 7.8 | 2025-12-23 | RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2025-14494 | High | 7.8 | 2025-12-23 | RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2025-14493 | High | 7.8 | 2025-12-23 | RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2025-14492 | High | 7.8 | 2025-12-23 | RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2025-14491 | High | 7.8 | 2025-12-23 | RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2025-14490 | High | 7.8 | 2025-12-23 | RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2025-14489 | High | 7.8 | 2025-12-23 | RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2025-14488 | High | 7.8 | 2025-12-23 | RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2025-59788 | Medium | 6.4 | 2025-12-04 | Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28… |
CVE-2025-64443 | Critical | 9.6 | 2025-12-03 | MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or streaming transport m… |
CVE-2025-47353 | High | 7.8 | 2025-11-04 | Memory corruption while processing request sent from GVM. |
CVE-2025-61907 | Medium | 6.5 | 2025-10-16 | Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could a… |
CVE-2025-59403 | Critical | 9.8 | 2025-10-02 | The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication. It is responsible for the camera f… |
CVE-2022-31491 | Critical | 10.0 | 2025-08-22 | Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbit… |
CVE-2025-34114 | | | 2025-07-25 | A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments, due to the a… |
CVE-2025-53964 | Critical | 9.6 | 2025-07-17 | GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary and then searches for… |
CVE-2025-37097 | High | 7.5 | 2025-07-01 | A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service |
CVE-2025-5823 | Medium | 6.5 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers… |
CVE-2025-5748 | High | 8.0 | 2025-06-06 | WOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execut… |
CVE-2025-30359 | Medium | 5.3 | 2025-06-03 | webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source… |
CVE-2025-48415 | Medium | 6.2 | 2025-05-21 | A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands… |
CVE-2025-43003 | Medium | 6.4 | 2025-05-13 | SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying… |
CVE-2025-43955 | Low | 2.2 | 2025-04-20 | TwsCachedXPathAPI in Convertigo through 8.3.4 does not restrict the use of commons-jxpath APIs. |
CVE-2025-3698 | High | 7.5 | 2025-04-16 | Interface exposure vulnerability in the mobile application (com.transsion.carlcare) may lead to information leakage risk. |
CVE-2025-26651 | Medium | 6.5 | 2025-04-08 | Exposed dangerous method or function in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
CVE-2024-43065 | High | 7.1 | 2025-04-07 | Cryptographic issues while generating an asymmetric key pair for RKP use cases. |
CVE-2024-6863 | Medium | 6.5 | 2025-03-20 | In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their ch… |
CVE-2024-12651 | High | 8.5 | 2025-02-14 | Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables.
This issue affects HGS Mobile App… |
CVE-2025-24361 | Medium | 5.3 | 2025-01-25 | Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack build… |
CVE-2025-24359 | High | 8.4 | 2025-01-24 | ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can b… |
CVE-2024-55945 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55924 | High | 8.0 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55923 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55922 | Medium | 5.4 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55921 | High | 7.5 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55920 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55894 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55893 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-13242 | Critical | 9.1 | 2025-01-09 | Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*. |
CVE-2023-39470 | High | 7.2 | 2024-11-22 | PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2024-51992 | Medium | 4.1 | 2024-11-11 | Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. This vulnerability i… |
CVE-2024-47005 | High | 8.1 | 2024-10-25 | Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted.
A n… |
CVE-2024-4739 | Medium | 5.3 | 2024-10-18 | The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable. By acquiring a valid authe… |
CVE-2024-6510 | High | 7.8 | 2024-09-12 | Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking. |
CVE-2024-6689 | High | 7.8 | 2024-07-15 | Local Privilege Escalation in MSI-Installer in baramundi Management Agent v23.1.172.0 on Windows allows a local unprivileged user to escalate privileges to SYS… |
CVE-2024-35209 | Medium | 6.2 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is allowing HTTP methods like… |
CVE-2024-5299 | High | 8.8 | 2024-05-23 | D-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2024-5298 | High | 8.8 | 2024-05-23 | D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2023-51584 | High | 8.8 | 2024-05-03 | Voltronic Power ViewPower USBCommEx shutdown Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2023-51583 | Critical | 9.8 | 2024-05-03 | Voltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… |
CVE-2023-51582 | Critical | 9.8 | 2024-05-03 | Voltronic Power ViewPower LinuxMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu… |
CVE-2023-51581 | Critical | 9.8 | 2024-05-03 | Voltronic Power ViewPower MacMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute… |
CVE-2023-51578 | High | 7.5 | 2024-05-03 | Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denia… |