🔥 Trending CVEs - Last 90 Days

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Grav CMS versions before 1.7.49.5. Attackers can exploit Twig template proces...

This vulnerability allows authenticated namespace administrators in OpenShift GitOps to create ArgoCD Custom Resources that grant them elevated permis...

CVE-2025-66430 is an incorrect access control vulnerability in Plesk's Password Protected Directories feature that allows authenticated Plesk users to...

CVE-2025-58130 is an insufficiently protected credentials vulnerability in Apache Fineract that could allow attackers to access sensitive authenticati...

An out-of-bounds read vulnerability in AzeoTech DAQFactory allows attackers to read memory beyond allocated buffers, potentially exposing sensitive in...

This vulnerability allows authorized or administrative users to install and execute untrusted extensions on ScreenConnect servers, potentially leading...

This CVE describes a mobile application vulnerability where the app allows clear text HTTP traffic to all domains, enabling man-in-the-middle attacks....

This vulnerability allows attackers to intercept and manipulate TLS traffic between a mobile application and its server due to missing certificate val...

DataGear v5.5.0 contains a path traversal vulnerability (CWE-22) that allows attackers to delete arbitrary files on the server. This affects all DataG...

A stored cross-site scripting (XSS) vulnerability in Chamilo LMS allows low-privileged users (like trainers) to inject malicious JavaScript into cours...

This vulnerability allows low-privilege users in Chamilo LMS to upload malicious files containing stored XSS payloads through the Social Networks feat...

This CVE describes a second-order expression injection vulnerability in n8n's Form nodes that could allow unauthenticated attackers to inject and eval...

A stored cross-site scripting (XSS) vulnerability in RustFS Console allows attackers to inject malicious JavaScript that executes when administrators ...

An authenticated attacker on GitHub Enterprise Server could exploit an insecure URL redirect in the repository_pages API to leak privileged JWT tokens...

A Cross-Site Request Forgery (CSRF) vulnerability in Dolibarr ERP & CRM v22.0.9 allows remote attackers to escalate privileges by exploiting the notes...

This CVE describes a race condition vulnerability in Apple operating systems that allows shortcuts to bypass sandbox restrictions through improper han...

This CVE describes a sandbox escape vulnerability in SandboxJS library versions before 0.8.31. It allows sandboxed JavaScript code to bypass isolation...

Axigen Mail Server versions before 10.5.57 contain multiple stored XSS vulnerabilities in the WebAdmin interface. Attackers can inject malicious JavaS...

Authenticated users can upload malicious SVG files containing JavaScript in NocoDB versions before 0.301.0. When other users view these attachments, t...

This CVE describes a code injection vulnerability in the Vollstart Event Tickets with Ticket Scanner WordPress plugin that allows attackers to execute...

This vulnerability allows arbitrary code execution on Grist servers when using the pyodide sandbox flavor with untrusted spreadsheets. Attackers can r...

CVE-2026-23873 is a CSV injection vulnerability in hustoj's contest rank export functionality that allows attackers to embed Excel formulas in nicknam...

Altium 365 workspace endpoints have an overly permissive CORS policy that allows credentialed cross-origin requests from other Altium-controlled subdo...

A stored cross-site scripting vulnerability in Altium Forum allows authenticated attackers to inject malicious JavaScript into forum posts. When other...

CVE-2026-23520 is a command injection vulnerability in Arcane's docker management platform that allows authenticated users to execute arbitrary shell ...

This vulnerability in Eclipse Che che-machine-exec allows unauthenticated attackers to execute arbitrary commands and steal secrets (SSH keys, tokens)...

This vulnerability allows a Backup Administrator with legitimate credentials to execute arbitrary code as the postgres user by sending a malicious pas...

This vulnerability allows users with Backup Operator or Tape Operator privileges to write files with root/system-level permissions, potentially leadin...

This vulnerability allows authenticated Backup Operators to execute arbitrary code as the postgres user by sending malicious interval or order paramet...

This vulnerability allows authenticated Frappe users with specific permissions to be tricked into clicking malicious links that execute arbitrary code...

This vulnerability allows attackers to upload arbitrary files to WordPress sites using the WP Webhooks plugin, potentially leading to remote code exec...

This vulnerability allows attackers to execute arbitrary code or cause denial of service by providing a specially crafted ELF file with an oversized f...

NanoMQ versions before 0.24.4 contain a buffer overflow vulnerability when PUBLISH packets trigger both shared and vanilla subscriptions simultaneousl...