Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

2,031 alerts · page 13 of 102

  1. Critical (CVSS 9+) Published

    GHSA-9j25-mm2h-2f76 LXD has arbitrary file write on host via `exec-output` symlink in crafted image

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Canonical LXD

    Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named exec...

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-119923 Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: AWS babelfish-for-postgresql, Amazon Aurora PostgreSQL with Babelfish

    A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database pr...

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-84473 CVE-2026-84473

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Kiteworks ownCloud

    Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-71495 Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: open-wanderer wanderer

    Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and return...

  5. Critical (CVSS 9+) Published

    CVE-2026-122193 OS command injection in the example SSM documents in Trusted Remote Execution (REX)

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: AWS trusted-remote-execution

    OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 might allow an authenticated remote user who is permitted to invoke the Rex-RO or Rex-RW SSM document to execute arbitrary commands as root on the managed inst...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-90436 Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: apache axis, Apache Axis 1.x (EOL)

    ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present...

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-123488 Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: craftcms cms

    Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attac...

  10. Critical (CVSS 9+) Published

    CVE-2026-59105 Universal sysadmin credential vulnerability in Jumis

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: Jumis Pro SIA Jumis

    Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input - the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-76168 Apache James: ManageSieve file implementation cross-user path traversal

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Apache James

    In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect validation of file paths can result in path transversal, allowing to set arbitrary SIEVE scripts for other users. This allows a logged in attacker to set arbitrary SIEVE scripts for other users...

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-74756 Apache James: WebAdmin exposed without authentication on official Docker default

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: Apache James

    Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-76171 Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: Apache James

    In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

  14. Critical (CVSS 9+) Published

    CVE-2026-107622 BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: themekraft BuddyForms

    The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the bf_post_type parameter. This is due to the public frontend submission handler buddyforms_form_response_no_ajax() aut...

  15. Critical (CVSS 9+) Published

    CVE-2026-114630 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter

    CriticalCVSS 9.1 EPSS 1.3%

    Exploit status: No public exploit known

    Affects: ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System, wordpress elex-helpdesk-customer-support-ticket-system

    The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated atta...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-120844 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: wordpress miniorange-login-with-eve-online-google-facebook, miniOrange OAuth Single Sign On – SSO (OAuth Client)

    Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-119516 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Mamunur Rashid Radius Booking — Booking Calendar for Appointments &amp; Services

    Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.

  20. Critical (CVSS 9+) Published

    CVE-2026-118423 WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).