Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

2,031 alerts · page 8 of 102

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-124469 OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: openemr

    OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Sheet product lines with...

  2. Critical (CVSS 9+) Published

    CVE-2026-124463 OpenEMR before 8.3.0 Stored XSS via CAMOS Rx Print View

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: openemr

    OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajax_save.php. Attackers can store a script payload that executes unencoded when the entry is print...

  3. Critical (CVSS 9+) Published

    CVE-2026-124450 OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: openemr

    OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials and write arbitrary f...

  4. Critical (CVSS 9+) Published

    CVE-2026-124445 OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: openemr

    OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a cap...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-124440 Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: kyverno

    Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath. Attackers can create namespace...

  6. Critical (CVSS 9+) Published

    CVE-2026-124438 Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: nuget scriban, nuget Scriban.Signed

    Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on importe...

  7. Critical (CVSS 9+) Published

    CVE-2026-124427 Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: craftcms cms

    Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, s...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-110963 Userplace <= 1.2.0 - Unauthenticated Privilege Escalation

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: wordpress userplace-member-subscription-restriction-payments

    The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site o...

  9. Critical (CVSS 9+) Published

    CVE-2026-114432 Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename

    CriticalCVSS 9.8 EPSS 0.46%

    Exploit status: No public exploit known

    The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. O...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-123614 imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: imgproxy github.com/imgproxy/imgproxy/v3

    imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupti...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-123550 OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: org.openidentityplatform.openam/openam-federation-library, org.openidentityplatform.openam/openam-auth-saml2

    OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions t...

  12. Critical (CVSS 9+) Published

    CVE-2026-123551 OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: org.openidentityplatform.openam/openam-server-only, org.openidentityplatform.openam/openam-federation-library, org.openidentityplatform.openam/openam-notifications-websocket

    OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty...

  13. Critical (CVSS 9+) Published

    CVE-2026-123549 OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: org.openidentityplatform.openam/openam-core-rest

    OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow...

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-124060 TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink ca300-poe firmware

    A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File results in buffer overflow. The attack may be launched remotely. The exploit is now publi...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-124059 TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink ca300-poe firmware

    A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this vulnerability is the function setWiFiWdsAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ApCliKeyStr leads to buffer overflow. The attack may be initiated remot...

  16. Critical (CVSS 9+) Published

    CVE-2026-124058 TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink ca300-poe firmware

    A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has b...

  17. Critical (CVSS 9+) Published

    CVE-2026-124057 TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink ca300-poe firmware

    A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument Key1Str1 results in buffer overflow. The attack can be initiated remotely. The exploit h...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-123966 Tenda AC19 saveParentControlInfo heap-based overflow

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: tenda ac19

    A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-120984 Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: redhat build keycloak, redhat red hat single sign on

    A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker w...

  20. Critical (CVSS 9+) Published

    CVE-2026-122041 Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: ThemeHigh Checkout Field Editor for WooCommerce (Pro)

    The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is register...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).