|
2026-09-03
|
|
FreePBX 17.0.2 - Remote Code Execution (RCE)
|
68 |
WEB
|
Jared Brits
|
|
2026-09-03
|
|
Metabase 0.61.0 - Authenticated Remote Code Execution
|
45 |
WEB
|
Gutierre0x80
|
|
2026-09-02
|
|
Bludit CMS 3.20.0 - Reflected Cross-Site Scripting
|
43 |
WEB
|
Ranjit Kumar Singh
|
|
2026-09-02
|
|
PodcastGenerator 3.2.9 - Stored XSS
|
46 |
WEB
|
Sahil Arya
|
|
2026-09-02
|
|
Ghost_CMS 6.19.0 - Remote Code Execution
|
38 |
WEB
|
Maksim Rogov
|
|
2026-09-02
|
|
Langflow 1.10.0 - RCE
|
49 |
WEB
|
Richard Howe
|
|
2026-09-02
|
|
Fullhan FH8626V100 - Multiple Vulnerabilities
|
37 |
WEB
|
Amir Aliu
|
|
2026-09-02
|
|
Marimo 0.20.4 - RCE
|
50 |
WEB
|
Jason Bernier
|
|
2026-09-01
|
|
Wolf CMS 0.8.3.1 - RCE v
|
50 |
WEB
|
Balachandar Gowrisankar
|
|
2026-09-01
|
|
Payload CMS 3.72.0 - Blind SQL Injection
|
40 |
WEB
|
cardosource
|
|
2026-09-01
|
|
Bludit CMS - Stored XSS
|
33 |
WEB
|
Saud Alenazi
|
|
2026-09-01
|
|
Grav CMS 2.0.7 - RCE
|
28 |
WEB
|
zer0dayf
|
|
2026-09-01
|
|
miniOrange 5.4.3 - Unauthenticated Auth Bypass
|
29 |
WEB
|
zer0dayf
|
|
2026-09-01
|
|
EasyAppointments 1.5.1 - Blind SQL Injection
|
25 |
WEB
|
Michael Chesang
|
|
2026-08-31
|
|
C-MOR 6.0104 - Directory Traversal
|
33 |
WEB
|
Samir Shamdin
|
|
2026-08-31
|
|
C-MOR 6.0104 - Cross-Site Scripting (XSS)
|
29 |
WEB
|
Samir Shamdin
|
|
2026-08-31
|
|
CubeCart 6.7.4 - SQL injection
|
28 |
WEB
|
Mikail KOCADAĞ
|
|
2026-08-31
|
|
CubeCart 6.7.4 - SQL
|
31 |
WEB
|
Mikail KOCADAĞ
|
|
2026-08-31
|
|
CubeCart 6.7.4 - Stored XSS
|
32 |
WEB
|
Mikail KOCADAĞ
|
|
2026-08-31
|
|
CubeCart 6.7.4 - Cross-Site Scripting
|
29 |
WEB
|
Mikail KOCADAĞ
|
|
2026-08-31
|
|
Linksys E1200_2.0.04 - Unauthenticated OS Command Injection
|
25 |
WEB
|
jarrett
|
|
2026-08-31
|
|
Langflow 1.8.4 - Path Traversal to Remote Code Execution
|
33 |
WEB
|
cardosource
|
|
2026-08-18
|
|
flyto-core 2.26.7 - Arbitrary File Write
|
50 |
WEB
|
Jorge González Milla
|
|
2026-08-18
|
|
Nodemailer 9.0.0 - File Read/ SSRF
|
38 |
WEB
|
Jorge González Milla
|
|
2026-08-18
|
|
Linuxfabrik monitoring_plugins_6.0.0 - SSRF
|
35 |
WEB
|
Jorge González Milla
|
|
2026-08-17
|
|
flyto_core 2.26.7 - Server-Side Request Forgery
|
39 |
WEB
|
Jorge González Milla
|
|
2026-08-17
|
|
Probo 0.222.2 - IDOR
|
40 |
WEB
|
Jorge González Milla
|
|
2026-08-17
|
|
webpack_devserver 5.2.5 - CSRF
|
49 |
WEB
|
Jorge González Milla
|
|
2026-08-17
|
|
Duplicati 2.2.0.3 - JWT Signing Key Leak
|
47 |
WEB
|
Gabriel Rodrigues
|
|
2026-08-17
|
|
Joomla JCE_2.9.15 - Remote Code Execution
|
52 |
WEB
|
Jared Brits
|
|
2026-08-17
|
|
WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
|
95 |
WEB
|
Mohammad Hossein Sadeghian
|
|
2026-08-11
|
|
Apache Gravitino 1.2.1 - SSRF
|
74 |
WEB
|
Ajay Rajpurohit
|
|
2026-08-11
|
|
Blocksy Companion 2.1.46 - RCE
|
48 |
WEB
|
banyamer
|
|
2026-08-11
|
|
Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF
|
42 |
WEB
|
Balachandar Gowrisankar
|
|
2026-08-11
|
|
Ray 2.56.0 - Directory Traversal & Local File Inclusion
|
47 |
WEB
|
Richard Howe
|
|
2026-08-10
|
|
OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution
|
40 |
WEB
|
banyamer
|
|
2026-08-10
|
|
CorgetGpsDget 2_3.2 - OS Command Injection
|
36 |
WEB
|
Bytetobreach
|
|
2026-08-10
|
|
Joomla 2.9.99.4 - Unauthenticated Remote Code Execution
|
61 |
WEB
|
Jared Brits
|
|
2026-07-08
|
|
Krayin CRM v2.2.x - Authenticated Remote Code Execution
|
91 |
WEB
|
Diamorphine
|
|
2026-07-08
|
|
Atarim WordPress Plugin 4.2.2 - Sensitive Information Exposure
|
82 |
WEB
|
Mohammad Hossein Sadeghian
|
|
2026-07-08
|
|
Langflow 1.9.0 - RCE
|
107 |
WEB
|
Diamorphine
|
|
2026-07-08
|
|
Joomla Page Builder CK 3.5.10 - Arbitrary File Upload
|
81 |
WEB
|
M@rAz Ali
|
|
2026-07-07
|
|
MCPJam Inspector - Remote Code Execution
|
65 |
WEB
|
Diamorphine
|
|
2026-07-07
|
|
Flowise 3.1.3 - arbitrary code execution
|
67 |
WEB
|
banyamer
|
|
2026-07-07
|
|
Discuz! X5.0 - Authentication Bypass
|
94 |
WEB
|
banyamer
|
|
2026-07-07
|
|
Tenable Nessus 10.12.1 - SQL Injection
|
57 |
WEB
|
banyamer
|
|
2026-07-07
|
|
WordPress Bricks Builder Theme - RCE
|
118 |
WEB
|
Jared Brits
|
|
2026-07-06
|
|
Joomla Extension 4.1.4 - PHP Object injection
|
82 |
WEB
|
Amin İsayev
|
|
2026-07-06
|
|
Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass
|
55 |
WEB
|
Onur BILICI
|
|
2026-07-06
|
|
KeepInMind 0.8.4.2 - Stored XSS
|
54 |
WEB
|
Pavan N
|
|
2026-07-06
|
|
KNX visualisering - Broken Access Control
|
47 |
WEB
|
Parsa Rezaie Khiabanloo
|
|
2026-07-06
|
|
WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS)
|
58 |
WEB
|
Kent Apostol
|
|
2026-06-08
|
|
OpenEMR 7.0.2 - Arbitrary File Read
|
78 |
WEB
|
doany1
|
|
2026-06-05
|
|
WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection
|
87 |
WEB
|
cardosource
|
|
2026-06-01
|
|
Drupal Core 10.5.5 - Error-Based SQL Injection
|
111 |
WEB
|
cardosource
|
|
2026-06-01
|
|
WordPress OrderConvo 14 - Path Traversal
|
87 |
WEB
|
Diamorphine
|
|
2026-05-30
|
|
YAMCS yamcs-core 5.12.7 - No Rate Limiting
|
75 |
WEB
|
Daniel Miranda
|
|
2026-05-30
|
|
YAMCS yamcs-core 5.12.7 - User Enumeration
|
71 |
WEB
|
Daniel Miranda
|
|
2026-05-30
|
|
YAMCS yamcs-core 5.12.7 - LDAP Injection
|
75 |
WEB
|
Daniel Miranda
|
|
2026-05-29
|
|
MikroORM 7.0.13 - SQL Injection
|
68 |
WEB
|
cardosource
|
|
2026-05-29
|
|
Prodigy Commerce 3.3.0 - Local File Inclusion
|
76 |
WEB
|
Diamorphine
|
|
2026-05-29
|
|
Langflow 1.3.0 - Remote Code Execution
|
89 |
WEB
|
Diamorphine
|
|
2026-05-29
|
|
Quick Playground for WordPress 1.3.1 - Unauthenticated Remote Code Execution
|
84 |
WEB
|
cardosource
|
|
2026-05-29
|
|
MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution
|
74 |
WEB
|
cardosource
|
|
2026-05-29
|
|
CubeCart < 6.7.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
|
64 |
WEB
|
Th3-SAx11
|
|
2026-05-27
|
|
Casdoor 3.54.1 - Arbitrary File Write via Path Traversal
|
64 |
WEB
|
sixpain
|
|
2026-05-27
|
|
EspoCRM 9.3.3 - SSRF
|
56 |
WEB
|
Max Gabriel
|
|
2026-05-27
|
|
scramble - Remote Code Execution
|
60 |
WEB
|
joshua
|
|
2026-05-27
|
|
MeiG Smart FORGE_SLT711 - OS Command Injection
|
51 |
WEB
|
Daniil Gordeev
|
|
2026-05-27
|
|
OpenCATS 0.9.7.4 - SQL Injection
|
52 |
WEB
|
Gabriel Rodrigues
|
|
2026-05-26
|
|
Grav CMS 2.0.0-beta.2 - Remote Code Execution
|
54 |
WEB
|
Mustafa Murat Akgül
|
|
2026-05-26
|
|
Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service
|
48 |
WEB
|
alisunbul
|
|
2026-05-26
|
|
D-Link DSL2600U - 'rom-0' Admin Password Disclosure
|
46 |
WEB
|
Amir Hossein Jamshidi
|
|
2026-05-26
|
|
Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeov
|
57 |
WEB
|
Amir Hossein Jamshidi
|
|
2026-05-26
|
|
cPanel - CRLF Injection
|
74 |
WEB
|
nu11secur1ty
|
|
2026-05-21
|
|
Cockpit 359 - RCE
|
69 |
WEB
|
Abdelazim Mohammed
|
|
2026-05-21
|
|
BookStack 25.12.1 - Denial of Service
|
60 |
WEB
|
Gabriel Rodrigues
|
|
2026-05-21
|
|
solaredge - (CSRF-OOB-Injection)
|
56 |
WEB
|
nu11secur1ty
|
|
2026-05-21
|
|
FUXA 1.2.9 - RCE
|
71 |
WEB
|
Anthony Cihan
|
|
2026-05-14
|
|
WordPress Plugin Supsystic Contact Form 1.7.36 - SSTI
|
58 |
WEB
|
bootstrapbool
|
|
2026-05-14
|
|
Apache HertzBeat 1.8.0 - Remote Code Execution
|
60 |
WEB
|
Brett Gervasoni
|
|
2026-05-14
|
|
ePati Antikor NGFW 2.0.1301 - Authentication Bypass
|
50 |
WEB
|
sadik
|
|
2026-05-14
|
|
PJPROJECT 2.16 - Heap Bufferoverflow
|
47 |
WEB
|
vabismo452
|
|
2026-05-13
|
|
Ninja Forms Uploads - Unauthenticated PHP File Upload
|
68 |
WEB
|
selim.lanouar
|
|
2026-05-13
|
|
glances 4.5.2 - command injection
|
60 |
WEB
|
best.sell
|
|
2026-05-13
|
|
coreruleset 4.21.0 - Firewall Bypass
|
52 |
WEB
|
anonimicerum
|
|
2026-05-13
|
|
Flowise < 3.0.5 - Missing Authentication for Critical Function
|
57 |
WEB
|
andersoncezar048
|
|
2026-05-07
|
|
Ghost CMS 6.19.0 - SQLi
|
79 |
WEB
|
Maksim Rogov
|
|
2026-05-07
|
|
LuaJIT 2.1.1774638290 - Arbitrary Code Execution
|
58 |
WEB
|
Taurus Omar
|
|
2026-05-07
|
|
Bludit CMS 3.18.4 - RCE
|
62 |
WEB
|
yahia
|
|
2026-05-07
|
|
ThingsBoard IoT Platform 4.2.0 - Server-Side Request Forgery (SSRF)
|
56 |
WEB
|
9tamilmathi
|
|
2026-05-04
|
|
Linksys E1200 2.0.04 - Authenticated Stack Buffer Overflow (RCE)
|
54 |
WEB
|
jarrett
|
|
2026-05-04
|
|
MindsDB 25.9.1.1 - Path Traversal
|
54 |
WEB
|
thewhiteh4t
|
|
2026-05-04
|
|
Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)
|
45 |
WEB
|
hazar
|
|
2026-04-30
|
|
FUXA 1.2.8 - Authentication Bypass + RCE Exploit
|
77 |
WEB
|
joshua
|
|
2026-04-30
|
|
Python-Multipart 0.0.22 - Path Traversal
|
67 |
WEB
|
jefersoncardoso.dev
|
|
2026-04-30
|
|
Repetier-Server 1.4.10 - Path Traversal
|
38 |
WEB
|
banyamer
|
|
2026-04-30
|
|
HUSTOJ Zip-Slip v26.01.24 - RCE
|
43 |
WEB
|
Marshall Whittaker
|
|
2026-04-30
|
|
BusyBox 1.37.0 - Path Traversal
|
58 |
WEB
|
Calil Khalil
|
|
2026-04-30
|
|
JUNG Smart Visu Server 1.1.1050 - Dos
|
48 |
WEB
|
banyamer
|
|
2026-04-30
|
|
SumatraPDF 3.5.2 - Remote Code Execution
|
69 |
WEB
|
banyamer
|
|
2026-04-30
|
|
NiceGUI 3.6.1 - Path Traversal
|
40 |
WEB
|
banyamer
|
|
2026-04-30
|
|
Frigate NVR 0.16.3 - Remote Code Execution
|
29 |
WEB
|
jduardo2704
|
|
2026-04-30
|
|
Js2Py 0.74 - RCE
|
45 |
WEB
|
alisunbul
|
|
2026-04-30
|
|
Camaleon CMS v2.9.0 - Path Traversal
|
32 |
WEB
|
velampudisakshi
|
|
2026-04-30
|
|
Cybersecurity AI (CAI) Framework 0.5.10 - Command Injection
|
40 |
WEB
|
banyamer
|
|
2026-04-30
|
|
Erugo 0.2.14 - Remote Code Execution (RCE)
|
37 |
WEB
|
abdulmoiz
|
|
2026-04-30
|
|
deephas 1.0.7 - Prototype Pollution
|
42 |
WEB
|
banyamer
|
|
2026-04-30
|
|
SUSE Manager 4.3.15 - Code Execution
|
29 |
WEB
|
wjmaj98
|
|
2026-04-29
|
|
HAX CMS 24.x - Stored Cross-Site Scripting (XSS)
|
35 |
WEB
|
banyamer
|
|
2026-04-29
|
|
Craft CMS 5.6.16 - RCE
|
84 |
WEB
|
banyamer
|
|
2026-04-29
|
|
phpMyFAQ 4.0.16 - Improper Authorization
|
46 |
WEB
|
contact
|
|
2026-04-29
|
|
GeographicLib v2.5.1 - stack buffer overflow
|
49 |
WEB
|
rosario
|
|
2026-04-29
|
|
OpenKM 6.3.12 - Multiple
|
38 |
WEB
|
skumar
|
|
2026-04-29
|
|
GUnet OpenEclass E-learning platform < 4.2 - Remote Code Execution (RCE)
|
33 |
WEB
|
unico007x
|
|
2026-04-29
|
|
JuzaWeb CMS 3.4.2 - Authenticated Remote Code Execution
|
43 |
WEB
|
sardordev02
|
|
2026-04-29
|
|
FacturaScripts 2025.43 - XSS
|
32 |
WEB
|
uvettrivel007
|
|
2026-04-29
|
|
Xibo CMS 4.3.0 - RCE via SSTI
|
41 |
WEB
|
Cristian Branet
|
|
2026-04-29
|
|
LangChain Core 1.2.4 - SSTI/RCE
|
38 |
WEB
|
banyamer
|
|
2026-04-22
|
|
WordPress Plugin 5.2.0 - Broken Access Control
|
51 |
WEB
|
cydev.turing
|
|
2026-04-10
|
|
D-Link DIR-650IN - Authenticated Command Injection
|
50 |
WEB
|
Sanjay Singh
|
|
2026-04-09
|
|
React Server 19.2.0 - Remote Code Execution
|
53 |
WEB
|
danieljavanrad
|
|
2026-04-09
|
|
RomM 4.4.0 - XSS_CSRF Chain
|
38 |
WEB
|
mmohammedheshamm
|
|
2026-04-09
|
|
Jumbo Website Manager - Remote Code Execution
|
38 |
WEB
|
Mirabbas Ağalarov
|
|
2026-04-08
|
|
FortiWeb 8.0.2 - Remote Code Execution
|
78 |
WEB
|
Mohammed Idrees Banyamer
|
