Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

2,028 alerts · page 1 of 102

  1. Critical (CVSS 9+) Published

    CVE-2026-126187 React: Unauthenticated Remote Code Execution in React Server Components

    CriticalCVSS 9.5

    Exploit status: No public exploit known

    Affects: react

    React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafte...

  2. Critical (CVSS 9+) Published

    CVE-2026-126261 A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated...

    CriticalCVSS 9.0

    Exploit status: No public exploit known

    Affects: fortinet fortimanager

    A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted F...

  3. Critical (CVSS 9+) Published

    CVE-2026-82391 Out-of-bounds write in Zephyr HTTP/2 server static-filesystem handler via corrupted receive-buffer length

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: zephyrproject zephyr

    The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output. In subsys/net/lib/http/http_server_http2.c, handle_http2_static_fs_resource() passed &client->data_len as the file_size out-parameter of http_server_find_file(). client->data_len...

  4. Critical (CVSS 9+) Published

    CVE-2026-119017 Adobe Experience Manager | Incorrect Authorization (CWE-863)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Adobe Experience Manager 6.5

    Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does...

  5. Critical (CVSS 9+) Published

    CVE-2026-114371 Adobe Experience Manager | Incorrect Authorization (CWE-863)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Adobe Experience Manager as a Cloud Service, Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS

    Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does...

  6. Critical (CVSS 9+) Published

    CVE-2026-113580 Adobe Experience Manager | Improper Control of Generation of Code ('Code Injection') (CWE-94)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Adobe Experience Manager as a Cloud Service, Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS

    Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary cod...

  7. Critical (CVSS 9+) Published

    CVE-2026-113579 Adobe Experience Manager | Improper Control of Generation of Code ('Code Injection') (CWE-94)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Adobe Experience Manager as a Cloud Service, Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS

    Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary cod...

  8. Critical (CVSS 9+) Published

    CVE-2026-125298 AsiaInfo Business Support System (BSS) Missing JWT Signature Verification

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: AsiaInfo International Business Support System, AsiaInfo International aether-menu

    AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in...

  9. Critical (CVSS 9+) Published

    CVE-2026-125297 AsiaInfo Business Support System (BSS) Missing Authentication

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: AsiaInfo International Business Support System, AsiaInfo International aether-menu

    AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform oth...

  10. Critical (CVSS 9+) Published

    CVE-2026-121898 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu...

  11. Critical (CVSS 9+) Published

    CVE-2026-121896 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu...

  12. Critical (CVSS 9+) Published

    CVE-2026-121352 Adobe Connect | Incorrect Authorization (CWE-863)

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access to sensitive resources. Exploitation of this issue does not require user interaction. Scope is...

  13. Critical (CVSS 9+) Published

    CVE-2026-121908 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu...

  14. Critical (CVSS 9+) Published

    CVE-2026-121887 Adobe Connect | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Expl...

  15. Critical (CVSS 9+) Published

    CVE-2026-121349 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to gain elevat...

  16. Critical (CVSS 9+) Published

    CVE-2026-121355 Adobe Connect | Incorrect Authorization (CWE-863)

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user intera...

  17. Critical (CVSS 9+) Published

    CVE-2026-121351 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended...

  18. Critical (CVSS 9+) Published

    CVE-2026-121889 Adobe Connect | Server-Side Request Forgery (SSRF) (CWE-918)

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

  19. Critical (CVSS 9+) Published

    CVE-2026-121894 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu...

  20. Critical (CVSS 9+) Published

    CVE-2026-121906 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Adobe Connect

    Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).