🔥 Trending CVEs - Last 90 Days

This vulnerability in the WordPress Final User plugin allows attackers to escalate privileges due to incorrect privilege assignment. Users running ver...

This vulnerability allows attackers to escalate privileges in the WordPress Institutions Directory plugin. Attackers could gain administrative access ...

This vulnerability allows attackers to escalate privileges in the Hospital Doctor Directory WordPress plugin, potentially gaining administrative acces...

This SQL injection vulnerability in the Ultra Portfolio WordPress plugin allows attackers to execute arbitrary SQL commands on the database. It affect...

This vulnerability allows attackers to execute arbitrary code through PHP object injection by exploiting insecure deserialization in the North WordPre...

This vulnerability allows attackers to inject malicious objects through deserialization of untrusted data in the Dental Care CPT WordPress plugin. Suc...

This vulnerability allows attackers to inject malicious objects through deserialization of untrusted data in the Tech Life CPT WordPress plugin. Succe...

This vulnerability allows remote attackers to execute arbitrary code through PHP object injection in the OneLife WordPress theme. Attackers can exploi...

This vulnerability allows attackers to inject malicious objects through deserialization of untrusted data in the Anona WordPress theme. It affects all...

This vulnerability allows attackers to inject malicious objects through insecure deserialization in the Vivagh WordPress theme. Attackers could execut...

This vulnerability allows attackers to inject malicious objects through deserialization of untrusted data in the Eventin WordPress plugin. Attackers c...

This vulnerability allows attackers to escalate privileges in the Lawyer Directory WordPress plugin due to incorrect privilege assignment. Attackers c...

This vulnerability allows attackers to inject malicious objects through deserialization of untrusted data in the Kids Heaven WordPress theme. Attacker...

This CVE describes a Missing Authorization vulnerability in the merkulove Imager for Elementor WordPress plugin that allows attackers to bypass access...

This CVE describes a missing authorization vulnerability in the Carter for Elementor WordPress plugin that allows attackers to bypass access controls....

This CVE describes a Missing Authorization vulnerability in the Searcher for Elementor WordPress plugin that allows attackers to bypass access control...

This CVE describes a Missing Authorization vulnerability in the Motionger for Elementor WordPress plugin that allows attackers to bypass access contro...

This CVE describes a Missing Authorization vulnerability in the WP-CRM System WordPress plugin that allows attackers to bypass access controls and per...

This CVE describes a Missing Authorization vulnerability in the Bard WordPress theme that allows attackers to bypass access controls. It affects all B...

This CVE describes a missing authorization vulnerability in the Ninetheme Electron WordPress theme that allows attackers to bypass access controls. It...

This vulnerability allows attackers to escalate privileges in the Jthemes xSmart WordPress theme due to incorrect privilege assignment. Attackers can ...

This CVE describes a Missing Authorization vulnerability in the Jthemes xSmart WordPress theme that allows attackers to bypass access controls. Attack...

This CVE describes a missing authorization vulnerability in the HomeLancer WordPress theme that allows attackers to bypass access controls. Attackers ...

This SQL injection vulnerability in the ZoomIt DZS Video Gallery WordPress plugin allows attackers to execute arbitrary SQL commands on the database. ...

This SQL injection vulnerability in the WP Lead Capturing Pages WordPress plugin allows attackers to execute arbitrary SQL commands on the database. I...

This CSRF vulnerability in bdthemes Element Pack Elementor Addons allows attackers to trick authenticated WordPress administrators into performing uni...

This SQL injection vulnerability in Dell Unisphere for PowerMax allows low-privileged remote attackers to execute arbitrary commands on affected syste...

A stack-based buffer overflow vulnerability in Tenda AX1803 routers allows remote attackers to execute arbitrary code by manipulating parameters in th...

A buffer overflow vulnerability in Totolink NR1800X routers allows remote attackers to execute arbitrary code by sending specially crafted POST reques...

This CVE describes a remote command injection vulnerability in Sangfor Operation and Maintenance Management System's SSH Protocol Handler. Attackers c...

CVAT users with staff status can escalate their own privileges to superuser/admin level, gaining full access to all data in the CVAT instance. This af...

This vulnerability allows arbitrary code execution on vLLM servers during model loading. Attackers who can influence the model repository or path (loc...

The External Secrets Operator's getSecretKey template function allows cross-namespace secret retrieval, bypassing Kubernetes RBAC controls. This affec...

This CVE describes an Insecure Direct Object Reference (IDOR) vulnerability in D-Link D-View 8 network management software. Any authenticated user can...

Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations on...

Rockstar Games Launcher version 1.0.37.349 has insecure file permissions on its RockstarService.exe that allow authenticated users to replace it with ...

OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to upload malicious hardware con...

IBM Concert versions 1.0.0 through 2.1.0 contain an unrestricted file upload vulnerability that allows attackers to upload malicious files to the web ...

This vulnerability allows authenticated WordPress users with contributor-level access or higher to modify arbitrary WordPress options due to missing c...

This CVE describes a use-after-free vulnerability in ANGLE (Almost Native Graphics Layer Engine) in Google Chrome that could allow heap corruption. At...

This vulnerability in Chrome's V8 JavaScript engine allows attackers to read memory outside intended boundaries via malicious web pages. It affects al...

This vulnerability in Chrome's V8 JavaScript engine allows attackers to corrupt memory objects through malicious HTML pages, potentially leading to ar...

This vulnerability allows a remote attacker to trigger out-of-bounds memory access in Chrome's V8 JavaScript engine, potentially leading to memory cor...

node-tar versions up to 7.5.3 have a race condition vulnerability that allows arbitrary file overwrite via symlink poisoning attacks. This occurs when...

A remote buffer overflow vulnerability in Totolink LR350 routers allows attackers to execute arbitrary code by sending specially crafted POST requests...

A buffer overflow vulnerability in the Totolink LR350 router's WiFi configuration function allows remote attackers to execute arbitrary code. This aff...

A buffer overflow vulnerability in Totolink LR350 routers allows remote attackers to execute arbitrary code by manipulating the ssid parameter in the ...

This vulnerability allows remote attackers to execute arbitrary code on UTT 进取 520W routers by exploiting a buffer overflow in the ConfigExceptAli...

This vulnerability allows remote attackers to execute arbitrary code on UTT 进取 520W routers through a buffer overflow in the ConfigExceptQQ functi...

A buffer overflow vulnerability in UTT 进取 520W firmware version 1.7.7-180627 allows remote attackers to execute arbitrary code or cause denial of ...