Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

2,031 alerts · page 9 of 102

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-123776 RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: cpan RRD-CGI-Image

    RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process. The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation....

  2. Critical (CVSS 9+) Published

    CVE-2026-104014 Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization

    CriticalCVSS 9.8 EPSS 0.72%

    Exploit status: No public exploit known

    Affects: naimurrahmannahid Naimur Email OTP Verification for WooCommerce

    The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by...

  3. Critical (CVSS 9+) Published

    CVE-2026-119075 Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: ThemeGrill Registration Form for WooCommerce

    The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields())...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-118066 Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the OsModel::build_conditions_query() function in lib/mode...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-121265 SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: cpan SQL-Abstract

    SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update. With the array_datatypes option off, which is the default, insert(), update() and values() treat an arrayref column value as literal SQL. Its first element goes...

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-123961 TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink ca300-poe firmware

    A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument KeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been d...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-123960 TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink ca300-poe firmware

    A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument pppoeUser/priDns/secDns can lead to buffer overflow. The attack can be launched remotely. The exploit h...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-123959 TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink ca300-poe firmware

    A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument langType results in buffer overflow. The attack can be initiated remotely. The explo...

  9. Critical (CVSS 9+) Published

    CVE-2026-123958 TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink ca300-poe firmware

    A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument lanDns/lanSecDns/langType leads to buffer overflow. It is possible to launch the attack remotely. T...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-123957 TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: totolink ca300-poe firmware

    A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly...

  11. Critical (CVSS 9+) Published

    CVE-2026-121379 Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-c...

  12. Critical (CVSS 9+) Published

    CVE-2026-121491 Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header

    CriticalCVSS 9.0

    Exploit status: No public exploit known

    The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled an...

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-18535 IBM API Connect Denial of Service

    CriticalCVSS 9.6

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.

  14. Critical (CVSS 9+) Published

    CVE-2026-18838 Multiple Vulnerabilities in IBM API Connect

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-18836 Multiple Vulnerabilities in IBM API Connect

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the...

  16. Critical (CVSS 9+) Published

    CVE-2026-17410 Multiple Vulnerabilities in IBM API Connect

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-17409 Multiple Vulnerabilities in IBM API Connect

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-17408 Multiple Vulnerabilities in IBM API Connect

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-17403 Multiple Vulnerabilities in IBM API Connect

    CriticalCVSS 9.0

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-17402 Multiple Vulnerabilities in IBM API Connect

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).