Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

2,031 alerts · page 5 of 102

  1. Critical (CVSS 9+) Published

    CVE-2026-124903 Sandbox escape due to use-after-free in the IPC component

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    Affects: mozilla Firefox, mozilla Thunderbird

    Sandbox escape due to use-after-free in the IPC component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

  6. Critical (CVSS 9+) Published

    CVE-2026-82509 V Programming Language net.http TLS Certificate Validation Bypass

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: vlang/v

    V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate an...

  7. Critical (CVSS 9+) Published

    CVE-2026-112136 A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does....

    CriticalCVSS 9.2

    Exploit status: No public exploit known

    Affects: Siemens Mendix Studio Pro 11, Siemens Mendix Studio Pro 11.12

    A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it po...

  8. Critical (CVSS 9+) Published

    CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: nerves-hub nerves hub web

    Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authentication and return...

  10. Critical (CVSS 9+) Published

    CVE-2026-115646 Partial String Comparison Vulnerability in HiRDB

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Hitachi HiRDB Server Version 10, Hitachi HiRDB Server Version 9, Hitachi HiRDB Server with Additional Function Version 9 and 2 more

    Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; HiRDB Server Version 9...

  11. Critical (CVSS 9+) Published

    CVE-2026-125086 D-Link M60 emDaemon MQTT Broker mosquitto.conf system hard-coded credentials

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: d-link M60

    A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disc...

  12. Critical (CVSS 9+) Published

    CVE-2026-120017 Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: SAP_SE SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)

    SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including...

  13. Critical (CVSS 9+) Published

    CVE-2026-109803 Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms)

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: SAP_SE SAP NetWeaver Knowledge Management (XML Forms)

    SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an unauthorized XSL tr...

  14. Critical (CVSS 9+) Published

    CVE-2026-109798 XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: SAP_SE SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

    SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read s...

  15. Critical (CVSS 9+) Published

    CVE-2026-109795 Missing authorization check in S4CRM

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: SAP_SE S4CRM

    SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within t...

  16. Critical (CVSS 9+) Published

    CVE-2026-89126 Memory Corruption vulnerability in SAP Web Dispatcher

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: SAP_SE SAP Web Dispatcher

    SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation cou...

  17. Critical (CVSS 9+) Published

    CVE-2026-107246 The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backen...

    CriticalCVSS 9.2

    Exploit status: No public exploit known

    Affects: WebPros Plesk extension "Site Import"

    The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution a...

  19. Critical (CVSS 9+) Published

    CVE-2026-89119 Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    Affects: SAP_SE SAP Web Dispatcher and Internet Communication Manager

    SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could...

  20. Critical (CVSS 9+) Published

    CVE-2026-89103 Broken Access Control in SAP Gateway

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: SAP_SE SAP Gateway

    SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perfor...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).