What’s Vulnerable › Latest

Latest vulnerabilities

Refreshed every 15 minutes from NVD, CVE.org and CISA KEV. Subscribe: RSS · Atom · JSON Feed.

• CVE-2026-106087 — (Hitachi Energy TRO600 Series Firmware), CVSS 8.7
• CVE-2026-10756 — (Hitachi Energy TRO600 Series Firmware), CVSS 7.7
• CVE-2026-115408 — ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets (Eclipse Foundation Eclipse KeyPont), CVSS 5.5
• CVE-2026-13162 — (Hitachi Energy CoreTec 4), CVSS 7.7
• CVE-2026-113644 — iofogctl command injection via Controller provisioning response (Eclipse Foundation Eclipse ioFog), CVSS 5.5
• CVE-2026-90728 — (Dell PowerProtect Data Domain), CVSS 6.3
• CVE-2026-105323 — Reflected XSS in Kulga Software's Kulga News Software (Kulga Software and Telecommunications Limited Company Kulga News Software), CVSS 6.1
• CVE-2026-90729 — (Dell PowerProtect Data Domain), CVSS 6.7
• CVE-2026-115216 — Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials (Eclipse Foundation Eclipse ioFog), CVSS 9.1
• CVE-2026-41022 — (Eaton easySoft Software), CVSS 5.9
• CVE-2026-10752 — Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field (hwk-fr Advanced Custom Fields: Extended), CVSS 4.8
• CVE-2026-109995 — Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content (wplakeorg Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode), CVSS 7.2
• CVE-2026-90730 — (Dell PowerProtect Data Domain), CVSS 6.5
• CVE-2026-112362 — @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets (@fastify/express), CVSS 9.1
• CVE-2026-90731 — (Dell PowerProtect Data Domain), CVSS 4.9
• CVE-2026-41021 — (Eaton easyE4), CVSS 7.5
• CVE-2026-90732 — (Dell PowerProtect Data Domain), CVSS 4.9
• CVE-2026-117499 — @fastify/session vulnerable to session revocation bypass via a logout race condition (@fastify/session), CVSS 3.7
• CVE-2026-56084 — (Dell PowerProtect Data Domain), CVSS 5.8
• CVE-2026-102800 — Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 (dj-extensions.com DJ-HelpfulArticles extension for Joomla), CVSS 8.7
• CVE-2026-41020 — (Eaton easyE4), CVSS 7.5
• CVE-2026-4337 — Unrestricted Upload of File in PuMuKIT application (PuMuKIT), CVSS 8.8
• CVE-2026-117541 — svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize() (darylldoyle svg-sanitizer), CVSS 5.3
• CVE-2026-117540 — svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop (darylldoyle svg-sanitizer), CVSS 7.5
• CVE-2026-117539 — darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass (darylldoyle svg-sanitizer), CVSS 3.5
• CVE-2026-117538 — REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter (redaxo core), CVSS 4.1
• CVE-2026-117537 — REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter (redaxo core), CVSS 4.1
• CVE-2026-117536 — REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation (redaxo core), CVSS 8.8
• CVE-2026-117535 — REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool (redaxo core), CVSS 6.1
• CVE-2026-117534 — REDAXO before 5.21.3 CSRF in Article History Plugin (redaxo core), CVSS 5.4
• CVE-2026-117533 — REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads (redaxo core), CVSS 4.4
• CVE-2026-117532 — REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin (redaxo core), CVSS 9.8
• CVE-2026-116900 — REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets (redaxo core), CVSS 5.4
• CVE-2026-116899 — REDAXO before 5.21.4 Broken Access Control in Slice Operations (redaxo core), CVSS 6.5
• CVE-2026-116898 — REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move (redaxo core), CVSS 7.1
• CVE-2026-116897 — REDAXO before 5.21.4 Missing Authorization in Version and History Previews (redaxo core), CVSS 6.5
• CVE-2026-116896 — REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables (redaxo core), CVSS 7.5
• CVE-2026-116895 — REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter (redaxo core), CVSS 5.4
• CVE-2026-116894 — REDAXO before 5.21.5 Insufficient Session Expiration on Password Change (redaxo core), CVSS 4.2
• CVE-2026-116893 — REDAXO core before 5.21.5 Missing Authorization in rex_api_package API (redaxo core), CVSS 6.8