Loading vulnerability catalog
Threat intelligence
Public CVEs with current exploit evidence, risk signals and related defensive or research tooling.
Exploits RSS| CVE and title | Evidence / dates | CVSS | EPSS | KEV | Vendor / product | Exploits | Updated |
|---|---|---|---|---|---|---|---|
| CVE-2026-75128Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint | Evidence —Published Oct 20, 2026 | 9.3HighCritical | 0.6%Low | — | chatchat-spaceLangchain-Chatchat | 11 Repository evidence |
| Oct 20, 2026 |
| CVE-2026-48908Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2 | Evidence Jul 7, 2026Published Jun 20, 2026 | 10.0HighCritical | 88.5%High | KEV | joomshaper.netSP Page Builder extension for Joomla | 131 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2026-39363Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket | Evidence Aug 24, 2026Published Apr 7, 2026 | 8.2HighHigh | 3.4%Low | — | vitejsvite, vite-plus | 62 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 24, 2026 |
|---|
| CVE-2026-1731Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) | Evidence Feb 13, 2026Published Feb 6, 2026 | 9.9HighCritical | 93.1%High | KEV | BeyondTrustRemote Support(RS) & Privileged Remote Access(PRA) | 62 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | Evidence Jul 14, 2026Published Jul 14, 2026 | 10.0HighCritical | 6.8%Low | KEV | SonicWallSMA1000 | 62 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2023-45249Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability | Evidence Jul 29, 2024Published Jul 24, 2024 | 9.8HighCritical | 53.3%High | KEV | AcronisAcronis Cyber Infrastructure | 22 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2021-36754PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds... | Evidence —Published Jul 27, 2021 | 7.5HighHigh | 64.9%High | — | n/an/a | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 4, 2024 |
|---|
| CVE-2021-27877Veritas Backup Exec Agent Improper Authentication Vulnerability | Evidence Apr 7, 2023Published Mar 1, 2021 | 9.8HighCritical | 64.9%High | KEV | n/an/a | 42 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2020-14644Oracle WebLogic Server Remote Code Execution Vulnerability | Evidence Sep 18, 2024Published Jul 15, 2020 | 9.8HighCritical | 94.5%High | KEV | Oracle CorporationWebLogic Server | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2026-73570Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | Evidence Aug 21, 2026Published Aug 13, 2026 | 8.9HighHigh | 71.7%High | KEV | ZimbraCollaboration | 91 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2026-23829Mailpit has SMTP Header Injection via Regex Bypass | Evidence Aug 25, 2026Published Jan 18, 2026 | 5.3ModerateMedium | 1.4%Low | — | axllentmailpit | 31 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 25, 2026 |
|---|
| CVE-2025-8286Güralp Systems FMUS Series and MIN Series Devices | Evidence —Published Jul 31, 2025 | 9.3HighCritical | 1.3%Low | — | Güralp SystemsGüralp FMUS Series, MIN Series Devices | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 15, 2025 |
|---|
| CVE-2024-54772An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is... | Evidence Aug 8, 2026Published Feb 11, 2025 | 5.4ModerateMedium | 1.2%Low | — | n/an/a | 31 Repository evidenceEvidence observed: Oct 13, 2026 | Aug 8, 2026 |
|---|
| CVE-2024-48208pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file. | Evidence Aug 4, 2026Published Oct 24, 2024 | 8.6HighHigh | 1.6%Low | — | n/an/a | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 4, 2026 |
|---|
| CVE-2023-48788Fortinet FortiClient EMS SQL Injection Vulnerability | Evidence Mar 25, 2024Published Mar 12, 2024 | 9.8HighCritical | 98.4%High | KEV | FortinetFortiClientEMS | 32 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2023-22629An issue was discovered in TitanFTP through 1.94.1205. The move-file function has a path traversal vulnerability in the newPath parameter. An authenticated... | Evidence Apr 6, 2023Published Feb 14, 2023 | 8.8HighHigh | 12.3%Moderate | — | n/an/a | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2021-30047VSFTPD 3.0.3 allows attackers to cause a denial of service due to limited number of connections allowed. | Evidence —Published Aug 22, 2023 | 7.5HighHigh | 3.2%Low | — | n/an/a | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Oct 3, 2024 |
|---|
| CVE-2020-9274An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the... | Evidence —Published Feb 26, 2020 | 7.5HighHigh | 6.0%Low | — | n/an/a | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 4, 2024 |
|---|
| CVE-2017-3881Cisco IOS and IOS XE Remote Code Execution Vulnerability | Evidence Apr 12, 2017Published Mar 17, 2017 | 9.8HighCritical | 99.0%High | KEV | n/aCisco IOS and IOS XE Software | 92 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2015-1419Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing. | Evidence —Published Jan 28, 2015 | 5.0ModerateMedium | 6.8%Low | — | n/an/a | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 6, 2024 |
|---|
| CVE-2011-3171Directory traversal vulnerability in pure-FTPd 1.0.22 and possibly other versions, when running on SUSE Linux Enterprise Server and possibly other operating... | Evidence —Published Nov 4, 2011 | 3.6LowLow | 0.6%Low | — | n/an/a | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 6, 2024 |
|---|
| CVE-2008-5281Heap-based buffer overflow in Titan FTP Server 6.05 build 550 allows remote attackers to execute arbitrary code via a long DELE command. | Evidence Feb 4, 2008Published Nov 29, 2008 | 10.0HighHigh | 6.4%Low | — | n/an/a | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2006-2173Buffer overflow in FileZilla FTP Server 2.2.22 allows remote authenticated attackers to cause a denial of service and possibly execute arbitrary code via a... | Evidence —Published May 4, 2006 | 6.4ModerateMedium | 6.7%Low | — | n/an/a | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 7, 2024 |
|---|
| CVE-2001-1473The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a... | Evidence —Published Apr 21, 2005 | 7.5HighHigh | 6.3%Low | — | n/an/a | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2024 |
|---|
| CVE-2026-9833Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter | Evidence Aug 9, 2026Published Jul 20, 2026 | 7.1HighHigh | 0.5%Low | — | UnknownTag Groups is the Advanced Way to Display Your Taxonomy Terms | 21 Repository evidenceEvidence observed: Oct 12, 2026 | Aug 9, 2026 |
|---|
| CVE-2026-97359HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection | Evidence —Published Sep 24, 2026 | 10.0HighCritical | 5.5%Low | — | rejettohfs2 | 11 Repository evidenceEvidence observed: Oct 26, 2026 | Sep 29, 2026 |
|---|
| CVE-2026-96652Plex Media Server SSRF | Evidence Oct 19, 2026Published Sep 23, 2026 | 5.3ModerateMedium | 1.8%Low | KEV | PlexMedia Server | 41 Repository evidenceEvidence observed: Nov 2, 2026 | Oct 20, 2026 |
|---|
| CVE-2026-9506Path Traversal Vulnerability in Bagisto | Evidence —Published Jun 8, 2026 | 8.7HighHigh | 1.4%Low | — | WebkulBagisto | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jun 8, 2026 |
|---|
| CVE-2026-9198Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation | Evidence Aug 4, 2026Published Jul 17, 2026 | 9.8HighCritical | 28.7%Moderate | KEV | IBMLangflow OSS | 112 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 3, 2026 |
|---|
| CVE-2026-90774rustypaste before 0.18.1 Path Traversal via filename header | Evidence —Published Sep 13, 2026 | 8.7HighHigh | 1.4%Low | — | orhunrustypaste | 11 Repository evidenceEvidence observed: Oct 22, 2026 | Sep 24, 2026 |
|---|
| CVE-2026-9062Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal | Evidence —Published Jun 13, 2026 | 3.4LowLow | 0.5%Low | — | UnknownStore Locator WordPress | 11 Repository evidenceEvidence observed: Oct 26, 2026 | Jun 15, 2026 |
|---|
| CVE-2026-89013Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php | Evidence Sep 12, 2026Published Sep 11, 2026 | 8.7HighHigh | 1.6%Low | — | DolibarrDolibarr | 21 Repository evidenceEvidence observed: Sep 28, 2026 | Sep 12, 2026 |
|---|
| CVE-2026-8839MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints | Evidence —Published Jun 6, 2026 | 5.3ModerateMedium | 1.0%Low | — | chrisvrichardsonMapPress Maps for WordPress | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jun 6, 2026 |
|---|
| CVE-2026-8679AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter | Evidence —Published May 22, 2026 | 7.5HighHigh | 1.6%Low | — | cssigniterteamAudioIgniter Music Player | 11 Repository evidenceEvidence observed: Sep 26, 2026 | May 22, 2026 |
|---|
| CVE-2026-85714Stirling-PDF: Remote Code Execution via H2 | Evidence Oct 18, 2026Published Oct 14, 2026 | 9.1HighCritical | 3.4%Low | — | Stirling-ToolsStirling-PDF | 21 Repository evidenceEvidence observed: Oct 22, 2026 | Oct 18, 2026 |
|---|
| CVE-2026-85688TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer | Evidence —Published Sep 4, 2026 | 9.3HighCritical | 2.6%Low | — | TEN-frameworkten-framework | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 14, 2026 |
|---|
| CVE-2026-85595Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth | Evidence —Published Sep 4, 2026 | 9.3HighCritical | 2.5%Low | — | traefiktraefik | 11 Repository evidenceEvidence observed: Oct 28, 2026 | Oct 8, 2026 |
|---|
| CVE-2026-8386WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID | Evidence —Published Jun 15, 2026 | 5.3ModerateMedium | 0.7%Low | — | UnknownWP Go Maps | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jun 15, 2026 |
|---|
| CVE-2026-8385WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback | Evidence —Published Jun 15, 2026 | 5.3ModerateMedium | 0.8%Low | — | UnknownWP Go Maps | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jun 15, 2026 |
|---|
| CVE-2026-8383LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API | Evidence —Published Jun 17, 2026 | 5.3ModerateMedium | 7.6%Low | — | UnknownLearnPress | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jun 17, 2026 |
|---|
| CVE-2026-82901Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field | Evidence —Published Sep 26, 2026 | 9.8HighCritical | 4.3%Low | — | themeficUltra Addons for Contact Form 7 | 11 Repository evidenceEvidence observed: Oct 23, 2026 | Sep 26, 2026 |
|---|
| CVE-2026-82456argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP | Evidence —Published Aug 29, 2026 | 10.0HighCritical | 2.4%Low | — | argoproj-labsargocd-mcp | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 24, 2026 |
|---|
| CVE-2026-8237Concrete CMS 9.5.0 and below is vulnerable to IDOR in the/ccm/frontend/conversations/message_detail endpoint | Evidence Aug 8, 2026Published May 21, 2026 | 6.3ModerateMedium | 0.6%Low | — | Concrete CMSConcrete CMS | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2026-8236Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID} | Evidence —Published May 21, 2026 | 6.3ModerateMedium | 0.7%Low | — | Concrete CMSConcrete CMS | 11 Repository evidenceEvidence observed: Sep 26, 2026 | May 22, 2026 |
|---|
| CVE-2026-82186WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter | Evidence —Published Sep 4, 2026 | 4.1ModerateMedium | 0.7%Low | — | UnknownWPLP Cookie Consent | 11 Repository evidenceEvidence observed: Oct 21, 2026 | Sep 4, 2026 |
|---|
| CVE-2026-81199MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route | Evidence —Published Sep 2, 2026 | 5.3ModerateMedium | 0.5%Low | — | UnknownMasterStudy LMS WordPress Plugin | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2026-8089weMail < 2.1.3 - Reflected Cross-Site Scripting | Evidence —Published Jun 17, 2026 | 7.1HighHigh | 0.5%Low | — | UnknownweMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce | 11 Repository evidenceEvidence observed: Oct 13, 2026 | Jun 17, 2026 |
|---|
| CVE-2026-80462Privilege Escalation in Progress Chef Automate | Evidence —Published Sep 11, 2026 | 10.0HighCritical | 2.0%Low | — | Progress SoftwareChef Automate | 11 Repository evidenceEvidence observed: Oct 13, 2026 | Sep 18, 2026 |
|---|
| CVE-2026-7798FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter | Evidence —Published May 22, 2026 | 5.4ModerateMedium | 0.7%Low | — | techjewelFluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | 11 Repository evidenceEvidence observed: Sep 26, 2026 | May 22, 2026 |
|---|
| CVE-2026-69251Flowise RCE via TypeORM DataSource | Evidence Aug 29, 2026Published Aug 4, 2026 | 9.0HighCritical | 2.7%Low | — | FlowiseAIFlowise, flowise-components | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 29, 2026 |
|---|