Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

2,031 alerts · page 14 of 102

  1. Critical (CVSS 9+) Published

    CVE-2026-88800 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from...

  2. Critical (CVSS 9+) Published

    CVE-2026-83493 Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: redhat openshift ai, redhat/rhoai/odh-training-cuda128-torch29-py312-rhel9

    A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base reposit...

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-113615 GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: wordpress gs-jwt-auth-and-otp-varification

    The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrato...

  4. Critical (CVSS 9+) Published

    CVE-2026-116533 Static Snapshot <= 0.2.1 - Unauthenticated RCE via 'name' Parameter

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.

  5. Critical (CVSS 9+) Published

    CVE-2026-115230 WHIZZ <= 1.1.8 - Unauthenticated Arbitrary User Password Reset

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fu...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-63774 Subnet Solutions PowerSYSTEM Center SQL Injection

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: Subnet Solutions PowerSYSTEM Center 2024, Subnet Solutions PowerSYSTEM Center 2026

    Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-63017 Subnet Solutions PowerSYSTEM Center Incorrect Authorization

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: Subnet Solutions PowerSYSTEM Center 2020, Subnet Solutions PowerSYSTEM Center 2024, Subnet Solutions PowerSYSTEM Center 2026

    Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-77596 Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    Affects: kubeflow pipelines

    Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeline, which returns wi...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-111494 Incorrect validation of TLS certificates in the MatchPoint Android app

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: TPC Software Matchpoint

    Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could rea...

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-111490 Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: TPC Software Matchpoint

    Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financi...

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-111489 A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: TPC Software Matchpoint

    A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

  14. Critical (CVSS 9+) Published

    CVE-2026-119757 BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: btcpayserver/btcpayserver

    BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon...

  15. Critical (CVSS 9+) Published

    CVE-2026-48705 MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

    CriticalCVSS 9.3 EPSS 0.51%

    Exploit status: No public exploit known

    Affects: Project-MONAI MONAI, pypi monai

    MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without v...

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-85076 Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)

    CriticalCVSS 9.0

    Exploit status: No public exploit known

    Affects: jhuckaby Cronicle

    Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api_update_event, or api...

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-46350 dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: dcmjs-org dcmjs

    dcmjs is a JavaScript implementation of DICOM manipulation. Prior to 0.52.0, the DecimalString and IntegerString implementations in src/ValueRepresentation.js sanitize text with a permissive regular expression and pass the result to JavaScript's Number constructor without validat...

  18. Critical (CVSS 9+) Published

    CVE-2026-102940 OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    Affects: openemr

    OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-116790 FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: signalwire freeswitch

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryp...

  20. CISA KEV addition Critical (CVSS 9+) Published · updated

    CVE-2026-116779 FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

    CriticalCVSS 9.8 EPSS 2.2% CISA KEV added 2026-11-09 · due 2026-11-12 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: signalwire freeswitch

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAG...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).