Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-62048 | Critical CVSS 9.3 |
- Applications & supply chain |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web /… | 1 Nov 2026 |
| CVE-2026-120338 | Critical CVSS 10.0 |
- Applications & supply chain |
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a… | 1 Nov 2026 |
| CVE-2026-120308 | Critical CVSS 9.9 |
- Network & security devices |
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host… | 1 Nov 2026 |
| CVE-2026-120307 | Critical CVSS 9.9 |
- Cloud & SaaS |
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the… | 1 Nov 2026 |
| CVE-2026-120306 | Critical CVSS 9.9 |
- Cloud & SaaS |
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on… | 1 Nov 2026 |
| CVE-2026-120198 | Critical CVSS 9.3 |
- Operating systems & software |
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the… | 1 Nov 2026 |
| CVE-2026-120195 | Critical CVSS 9.3 |
- Operating systems & software |
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the… | 1 Nov 2026 |
| CVE-2026-120189 | Critical CVSS 9.3 |
- Operating systems & software |
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of… | 1 Nov 2026 |
| CVE-2026-118636 | Critical CVSS 9.8 |
- Operating systems & software |
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls… | 31 Oct 2026 |
| CVE-2026-120209 | Critical CVSS 9.3 |
- Operating systems & software |
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid… | 31 Oct 2026 |
| CVE-2026-120201 | Critical CVSS 9.3 |
- Operating systems & software |
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to… | 31 Oct 2026 |
| CVE-2026-118235 | Critical CVSS 9.8 |
- Applications & supply chain |
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-103882 | Critical CVSS 9.1 |
- Applications & supply chain |
The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to… | 31 Oct 2026 |
| CVE-2026-119096 | Critical CVSS 9.8 |
- Applications & supply chain |
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and… | 31 Oct 2026 |
| CVE-2026-116512 | Critical CVSS 9.8 |
- Applications & supply chain |
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress… | 31 Oct 2026 |
| CVE-2026-89270 | Critical CVSS 9.1 |
- Applications & supply chain |
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to… | 31 Oct 2026 |
| CVE-2026-116557 | Critical CVSS 9.1 |
- Applications & supply chain |
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due… | 31 Oct 2026 |
| CVE-2026-109220 | Critical CVSS 9.8 |
- Applications & supply chain |
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object… | 31 Oct 2026 |
| CVE-2026-117656 | Critical CVSS 9.3 |
- Operating systems & software |
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth… | 31 Oct 2026 |
| CVE-2026-63377 | Critical CVSS 9.8 |
- Identity & access |
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural… | 30 Oct 2026 |
| CVE-2026-62863 | Critical CVSS 9.6 |
- Applications & supply chain |
MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`,… | 30 Oct 2026 |
| CVE-2026-62853 | Critical CVSS 9.9 |
- OT, ICS & IoT |
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts… | 30 Oct 2026 |
| CVE-2026-62849 | Critical CVSS 9.1 |
- OT, ICS & IoT |
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the… | 30 Oct 2026 |
| CVE-2026-117666 | Critical CVSS 9.1 |
- Applications & supply chain |
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an… | 30 Oct 2026 |
| CVE-2026-78403 | Critical CVSS 9.3 |
- Operating systems & software |
Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.