Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

2,031 alerts · page 17 of 102

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-122310 Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: kyverno

    Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide ../ segments behind # or ? to reach cluster...

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-122304 Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: kyverno

    Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall o...

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-122303 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: kyverno

    Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabrica...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-122302 Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: kyverno

    Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with gener...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-122051 Edimax BR-6208AC mp command injection

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: edimax br-6208ac firmware

    A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vend...

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-115770 Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    Affects: pocket-id github.com/pocket-id/pocket-id/backend, pocket-id

    Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-verification token only to the user's identi...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-54384 VitaFit Cloud API Authentication Bypass via POST /front/login/sns/

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: Shenzhen Shine Industrial Co., Ltd. VitaFit

    VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-52848 GLPI: MFA bypass

    CriticalCVSS 9.2

    Exploit status: No public exploit known

    Affects: glpi-project glpi

    GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-54378 VitaFit Cloud API Broken Access Control via S3 Token Endpoint

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: Shenzhen Shine Industrial Co., Ltd. VitaFit

    VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-57566 Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: readest

    Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-102894 GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

    CriticalCVSS 9.1 EPSS 0.26%

    Exploit status: No public exploit known

    Affects: pypi gpustack, gpustack

    GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without c...

  12. CISA KEV addition Critical (CVSS 9+) Published · updated

    CVE-2026-102895 GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

    CriticalCVSS 9.8 EPSS 0.56% CISA KEV added 2026-11-09 · due 2026-11-12 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: pypi gpustack, gpustack

    GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default....

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-97693 Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: xerrors Yuxi

    Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user wh...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-122013 Comfast CF-WR632AX Multipart webmgnt path traversal

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: comfast cf-wr632ax

    A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability is an unknown functionality of the file /usr/bin/webmgnt of the component Multipart Parser. Performing a manipulation of the argument filename results in path traversal. It is possible to i...

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-122220 WPO365 LOGIN before 45.2 SAML Replay Protection Bypass

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)

    WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message...

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-113373 Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: sonatype nexus repository manager

    Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid iden...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-121933 Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: linksys e5350

    A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remote...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-113780 ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: espressif esp-idf

    ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied stack pointer before sw...

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-107846 bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: bitcoinjs-lib

    bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was i...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).