Patchfirst
Patchfirst

Newest vulnerabilities

Most recently published CVEs with , status and techniques. Data built 2026-10-31 05:11 UTC.
100 of 9,988
  1. CVE-2026-117656Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth…
    pow-auth · assentCritical · 9.3
    No EPSS
    5h ago
  2. CVE-2026-63377TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language
    fctr-id · okta-ai-agentCritical · 9.8
    No EPSS
    6h ago
  3. CVE-2026-62853ThingLinks is an enterprise IoT platform
    mqttsnet · thinglinksCritical · 9.9
    No EPSS
    8h ago
  4. CVE-2026-62863MoLing is a computer-use and browser-use based MCP server
    gojue · molingCritical · 9.6
    No EPSS
    8h ago
  5. CVE-2026-78403Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows…
    Thalesgroup · Sentinel Keys ServerCritical · 9.8
    No EPSS
    9h ago
  6. CVE-2026-61850Kargo manages and automates the promotion of software artifacts
    akuity · kargoCritical · 9.3
    No EPSS
    9h ago
  7. CVE-2026-61620HoneySQL turns Clojure data structures into SQL
    seancorfield · honeysqlCritical · 9.8
    No EPSS
    9h ago
  8. CVE-2026-116241pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the…
    pgadmin.org · pgAdmin 4Critical · 9.9
    No EPSS
    9h ago
  9. CVE-2026-90888Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions
    leadsnap · LeadSnapCritical · 9.8
    No EPSS
    10h ago
  10. CVE-2026-39738Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions
    FunnelKit · FunnelKit AutomationsCritical · 9.8
    No EPSS
    10h ago
  11. CVE-2026-39732Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions
    Ivijan-Stefan Stipic · TransliteratorCritical · 9.3
    No EPSS
    10h ago
  12. CVE-2026-119526Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection
    ThemeREX · Royal EventCritical · 9.8
    No EPSS
    10h ago
  13. CVE-2026-116386Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions
    Cozy Vision Technologies Pvt. Ltd. · SMS Alert Order NotificationsCritical · 9.8
    No EPSS
    10h ago
  14. CVE-2026-61826Bazarr is a companion application to Sonarr and Radarr
    morpheus65535 · bazarrCritical · 10.0
    No EPSS
    12h ago
  15. CVE-2026-112816Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15…
    Canonical · LXDCritical · 10.0
    No EPSS
    12h ago
  16. CVE-2026-119706InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…
    InternLM · lmdeployCritical · 9.8
    No EPSS
    13h ago
  17. CVE-2026-93327A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration…
    Google Cloud · Application IntegrationCritical · 9.4
    No EPSS
    14h ago
  18. CVE-2026-61738SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs
    socfortress · CoPilotCritical · 10.0
    No EPSS
    14h ago
  19. CVE-2026-61737ng-antd-admin is an Angular and NestJS administration system template
    huajian123 · ng-antd-adminCritical · 9.8
    No EPSS
    14h ago
  20. CVE-2026-61729SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs
    socfortress · CoPilotCritical · 9.4
    No EPSS
    14h ago
  21. CVE-2026-61730SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs
    socfortress · CoPilotCritical · 9.3
    No EPSS
    14h ago
  22. CVE-2026-61728SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs
    socfortress · CoPilotCritical · 9.9
    No EPSS
    14h ago
  23. CVE-2026-119660MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…
    yincongcyincong · MuseBotCritical · 9.8
    No EPSS
    14h ago
  24. CVE-2015-20130Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in…
    Netsweeper · NetsweeperPublic exploitMedium · 6.1
    No EPSS
    14h ago
  25. CVE-2026-110799Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
    givanz · VvvebCritical · 9.8
    No EPSS
    14h ago
  26. CVE-2010-20125DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated…
    DedeCMS · DedeCMSHigh · 7.5
    No EPSS
    14h ago
  27. CVE-2026-119597OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers…
    AIDotNet · OpenDeepWikiCritical · 9.8
    No EPSS
    15h ago
  28. CVE-2026-116366An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user…
    ClickHouse · ClickHouseCritical · 9.5
    No EPSS
    18h ago
  29. CVE-2025-31704A vulnerability has been found in the Dahua Intelligent Connection Center
    Dahua · Intelligent Connection CenterCritical · 9.8
    No EPSS
    18h ago
  30. CVE-2026-82104In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9…
    Teltonika Networks · RUTCritical · 9.4
    0.4%Top 64%
    21h ago
  31. CVE-2026-103039The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including…
    Gravity Forms · Gravity FormsCritical · 9.8
    0.5%Top 57%
    22h ago
  32. CVE-2026-118539Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing
    Drupal · Commerce CoreMedium · 6.5
    0.2%Top 87%
    1d ago
  33. CVE-2026-107249Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX…
    Drupal · Block AJAXCritical · 9.8
    0.2%Top 91%
    1d ago
  34. CVE-2026-119263Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to…
    Google · ChromeCritical · 9.6
    0.2%Top 90%
    1d ago
  35. CVE-2026-119261Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially…
    Google · ChromeCritical · 9.6
    0.2%Top 88%
    1d ago
  36. CVE-2026-118527Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
    Ivanti · Connect SecureKEVT1190Exploit Public-Facing ApplicationT1105Ingress Tool Transfer
    No EPSS
    1d ago
  37. CVE-2023-22793A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the…
    Veeam · Management Pack for Microsoft System CenterCritical · 9.3
    0.5%Top 55%
    1d ago
  38. CVE-2026-61645Docat is a tool for hosting versioned static documentation
    docat-org · docatCritical · 9.1
    0.4%Top 65%
    1d ago
  39. CVE-2026-103093ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform
    ServiceNow · ServiceNow AI PlatformCritical · 9.4
    0.4%Top 63%
    1d ago
  40. CVE-2026-118769Botan is a C++ cryptography library
    randombit · botanCritical · 9.2
    0.4%Top 70%
    1d ago
  41. CVE-2026-118762Monkeytype is a minimalistic and customizable typing test
    monkeytypegame · monkeytypeCritical · 9.3
    0.3%Top 75%
    1d ago
  42. CVE-2026-107058An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another…
    Critical · 9.8
    0.5%Top 58%
    1d ago
  43. CVE-2026-93680IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…
    IBM · Langflow OSSPublic exploitCritical · 9.8
    2.3%Top 17%
    2d ago
  44. CVE-2026-90868An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on…
    Progress Software · WS_FTP ServerCritical · 9.9
    1.5%Top 26%
    2d ago
  45. CVE-2026-90866A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…
    Progress Software · WS_FTP ServerCritical · 9.1
    0.7%Top 46%
    2d ago
  46. CVE-2026-90863Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7…
    Progress Software · WS_FTP ServerCritical · 9.1
    0.7%Top 49%
    2d ago
  47. CVE-2026-90864A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…
    Progress Software · WS_FTP ServerCritical · 9.1
    0.5%Top 59%
    2d ago
  48. CVE-2026-84295Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could…
    Progress Software · WS_FTP ServerCritical · 10.0
    0.6%Top 54%
    2d ago
  49. CVE-2026-62018Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions
    ThemeREX · GunslingerCritical · 9.8
    0.4%Top 61%
    2d ago
  50. CVE-2026-62013Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions
    ThemeREX · Edge DecorCritical · 9.8
    0.4%Top 61%
    2d ago
  51. CVE-2026-62014Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions
    ThemeREX · EmojiNationCritical · 9.8
    0.4%Top 63%
    2d ago
  52. CVE-2026-62017Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions
    ThemeREX · Good HomesCritical · 9.8
    0.4%Top 64%
    2d ago
  53. CVE-2026-62016Unauthenticated PHP Object Injection in Gamic <= 1.19 versions
    ThemeREX · GamicCritical · 9.8
    0.4%Top 66%
    2d ago
  54. CVE-2026-62015Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions
    ThemeREX · GamezoneCritical · 9.8
    0.4%Top 66%
    2d ago
  55. CVE-2026-62131Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions
    Zoho Flow · Zoho FlowCritical · 9.8
    0.3%Top 76%
    2d ago
  56. CVE-2026-62009Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions
    ThemeREX · FilmaxCritical · 9.8
    0.4%Top 63%
    2d ago
  57. CVE-2026-62012Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions
    ThemeREX · CoinpressCritical · 9.8
    0.4%Top 64%
    2d ago
  58. CVE-2026-62008Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions
    ThemeREX · OrpheusCritical · 9.8
    0.4%Top 64%
    2d ago
  59. CVE-2026-62006Unauthenticated PHP Object Injection in Nuts <= 1.12 versions
    ThemeREX · NutsCritical · 9.8
    0.4%Top 64%
    2d ago
  60. CVE-2026-62011Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions
    ThemeREX · BonbonCritical · 9.8
    0.4%Top 66%
    2d ago
  61. CVE-2026-62010Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions
    ThemeREX · AvventureCritical · 9.8
    0.4%Top 66%
    2d ago
  62. CVE-2026-62005Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions
    ThemeREX · MuziconCritical · 9.8
    0.4%Top 66%
    2d ago
  63. CVE-2026-62004Unauthenticated PHP Object Injection in Motorix <= 1.11 versions
    ThemeREX · MotorixCritical · 9.8
    0.4%Top 66%
    2d ago
  64. CVE-2026-62002Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions
    ThemeREX · Meals & WheelsCritical · 9.8
    0.5%Top 56%
    2d ago
  65. CVE-2026-61997Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions
    ThemeREX · Legal StoneCritical · 9.8
    0.5%Top 56%
    2d ago
  66. CVE-2026-62001Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions
    ThemeREX · MarcellCritical · 9.8
    0.5%Top 59%
    2d ago
  67. CVE-2026-61998Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions
    ThemeREX · Le TruffeCritical · 9.8
    0.5%Top 59%
    2d ago
  68. CVE-2026-62003Unauthenticated PHP Object Injection in Mission <= 1.22 versions
    ThemeREX · MissionCritical · 9.8
    0.4%Top 66%
    2d ago
  69. CVE-2026-61991Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions
    Ajax Load More · AjaxLoadMore CacheCritical · 10.0
    0.7%Top 45%
    2d ago
  70. CVE-2026-61992Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions
    Von Eyal Fitoussi · GEO my WordPressCritical · 9.8
    0.4%Top 67%
    2d ago
  71. CVE-2026-54859Unauthenticated PHP Object Injection in Preservation <= 1.15 versions
    ThemeREX · PreservationCritical · 9.8
    0.5%Top 55%
    2d ago
  72. CVE-2026-54860Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions
    ThemeREX · OzistiCritical · 9.8
    0.5%Top 58%
    2d ago
  73. CVE-2026-54858Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions
    ThemeREX · PrintyCritical · 9.8
    0.5%Top 58%
    2d ago
  74. CVE-2026-54857Unauthenticated PHP Object Injection in Quirky <= 1.23 versions
    ThemeREX · QuirkyCritical · 9.8
    0.5%Top 58%
    2d ago
  75. CVE-2026-54856Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions
    ThemeREX · RexCoinCritical · 9.8
    0.5%Top 58%
    2d ago
  76. CVE-2026-119145Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload…
    frappe · frappeCritical · 9.9
    0.8%Top 45%
    2d ago
  77. CVE-2026-18894IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component…
    IBM · Langflow OSSCritical · 9.8
    0.4%Top 63%
    2d ago
  78. CVE-2026-112256Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server…
    OpenText · Advanced Authentication ServerCritical · 9.2
    0.2%Top 84%
    2d ago
  79. CVE-2026-111732P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the…
    RT-Labs · P-NetCritical · 9.3
    0.4%Top 65%
    2d ago
  80. CVE-2026-110186IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control…
    IBM · Langflow OSSCritical · 9.8
    0.6%Top 50%
    2d ago
  81. CVE-2026-107032Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an…
    Critical · 9.1
    0.5%Top 57%
    2d ago
  82. CVE-2026-104339IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…
    IBM · Langflow OSSCritical · 9.8
    0.7%Top 45%
    2d ago
  83. CVE-2026-104317IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute…
    IBM · Langflow OSSCritical · 9.8
    0.6%Top 53%
    2d ago
  84. CVE-2026-107015Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in…
    Critical · 9.1
    0.5%Top 57%
    2d ago
  85. CVE-2026-97854Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability
    Yamaha Corporation · NWR100Critical · 9.8
    1.4%Top 28%
    2d ago
  86. CVE-2026-115964Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes…
    StylemixThemes · MotorsCritical · 9.3
    0.3%Top 75%
    2d ago
  87. CVE-2026-114358This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in…
    Radius Synergies · Radius Xenia M2M PlatformCritical · 9.3
    0.5%Top 57%
    2d ago
  88. CVE-2026-115245The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a…
    Unknown · Chat AI with DispatcherCritical · 9.8
    0.5%Top 60%
    2d ago
  89. CVE-2026-113617The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before…
    Unknown · Automated Import Products to CartCritical · 9.9
    0.3%Top 72%
    2d ago
  90. CVE-2026-113616The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved…
    Unknown · LogixFast AuthCritical · 9.8
    0.3%Top 72%
    2d ago
  91. CVE-2026-42922A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809)
    frangoteam · FrangoteamCritical · 9.8
    0.5%Top 55%
    2d ago
  92. CVE-2026-109516The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account…
    guruteam · Bot for Telegram on WooCommerceCritical · 9.8
    0.6%Top 53%
    2d ago
  93. CVE-2026-66088In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating…
    Apereo Foundation · openEQUELLACritical · 9.4
    0.7%Top 47%
    2d ago
  94. CVE-2026-118579A weakness has been identified in D-Link DIR-505 1.10B02
    D-Link · DIR-505Critical · 9.8
    0.8%Top 44%
    2d ago
  95. CVE-2026-61564AVideo is a video-sharing Platform
    WWBN · AVideo-EncoderCritical · 10.0
    0.5%Top 55%
    2d ago
  96. CVE-2026-61567AVideo is a video-sharing Platform
    WWBN · AVideo-EncoderCritical · 10.0
    0.5%Top 55%
    2d ago
  97. CVE-2026-118690Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote…
    SignalK · signalk-serverCritical · 9.8
    0.7%Top 47%
    2d ago
  98. CVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference…
    Cisco · Secure Firewall ASA Software and Cisco Secure FTD SoftwareKEVHigh · 8.6T1190Exploit Public-Facing ApplicationT1499.004Application or System Exploitation
    0.9%Top 40%
    2d ago
  99. CVE-2026-63190FearlessCMS is a flat-file `content` management system centered on simplicity and open source
    fearlessgeekmedia · FearlessCMSCritical · 9.4
    0.5%Top 54%
    2d ago
  100. CVE-2026-118264Echo is a Go web framework
    labstack · echoCritical · 9.1
    0.4%Top 63%
    2d ago
j k move · Enter open · / search
↑ ↓ chooseEnter openEsc close