Loading vulnerability catalog
Threat intelligence
Public CVEs with current exploit evidence, risk signals and related defensive or research tooling.
Exploits RSS| CVE and title | Evidence / dates | CVSS | EPSS | KEV | Vendor / product | Exploits | Updated |
|---|---|---|---|---|---|---|---|
| CVE-2004-0437Titan FTP Server version 3.01 build 163, and possibly other versions before build 169, allows remote authenticated users to cause a denial of service... | Evidence May 4, 2004Published May 6, 2004 | 5.0ModerateMedium | 7.7%Low | — | n/an/a | 2 |
| Aug 8, 2026 |
| CVE-2001-1473The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a... | Evidence —Published Apr 21, 2005 | 7.5HighHigh | 6.3%Low | — | n/an/a | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2024 |
|---|
| CVE-2026-9586Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB | Evidence Sep 2, 2026Published Jul 17, 2026 | 9.3HighCritical | 19.0%Moderate | KEV | SangomaSwitchvox SMB Edition | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2026-9506Path Traversal Vulnerability in Bagisto | Evidence —Published Jun 8, 2026 | 8.7HighHigh | 1.8%Low | — | WebkulBagisto | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jun 8, 2026 |
|---|
| CVE-2026-93674Langflow OSS is affected by multiple vulnerabilities | Evidence Sep 22, 2026Published Oct 7, 2026 | 9.8HighCritical | 2.7%Low | — | IBMLangflow OSS | 21 Repository evidenceEvidence observed: Oct 11, 2026 | Sep 22, 2026 |
|---|
| CVE-2026-9290WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter | Evidence Aug 8, 2026Published Jun 5, 2026 | 7.5HighHigh | 2.7%Low | — | wpusermanagerWP User Manager – User Profile Builder & Membership | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2026-9282W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter | Evidence —Published Jul 11, 2026 | 7.5HighHigh | 2.9%Low | — | boldgridW3 Total Cache | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jul 14, 2026 |
|---|
| CVE-2026-9133Arbitrary file read in rabbitmq-aws plugin | Evidence —Published May 20, 2026 | 8.3HighHigh | 1.1%Low | — | AWSRabbitMQ AWS | 11 Repository evidenceEvidence observed: Sep 26, 2026 | May 21, 2026 |
|---|
| CVE-2026-9103Unauthenticated Superuser Token Issuance via Auto-Login Endpoint | Evidence Aug 28, 2026Published Jul 17, 2026 | 9.8HighCritical | 3.2%Low | — | IBMLangflow OSS | 41 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 28, 2026 |
|---|
| CVE-2026-9082Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 | Evidence May 22, 2026Published May 20, 2026 | 9.8HighCritical | 15.7%Moderate | KEV | DrupalDrupal core | 152 Repository evidenceEvidence observed: Sep 25, 2026 | Sep 2, 2026 |
|---|
| CVE-2026-89063Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter | Evidence —Published Sep 16, 2026 | 7.5HighHigh | 1.6%Low | — | ladelaOnline Scheduling and Appointment Booking System – Bookly | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 17, 2026 |
|---|
| CVE-2026-89013Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php | Evidence Sep 12, 2026Published Sep 11, 2026 | 8.7HighHigh | 1.6%Low | — | DolibarrDolibarr | 21 Repository evidenceEvidence observed: Sep 28, 2026 | Sep 12, 2026 |
|---|
| CVE-2026-8857Full RCE using EasyTimeline Extension | Evidence —Published Jul 1, 2026 | 0.0LowNone | 2.1%Low | — | Wikimedia Foundationtimeline | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jul 1, 2026 |
|---|
| CVE-2026-8839MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints | Evidence —Published Jun 6, 2026 | 5.3ModerateMedium | 1.3%Low | — | chrisvrichardsonMapPress Maps for WordPress | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jun 6, 2026 |
|---|
| CVE-2026-88062OmniRoute ACP Custom-Agent Remote Code Execution (RCE) | Evidence —Published Sep 10, 2026 | 9.5HighCritical | 1.4%Low | — | diegosouzapwOmniRoute | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 11, 2026 |
|---|
| CVE-2026-87820CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner | Evidence —Published Sep 9, 2026 | 6.9ModerateMedium | 0.9%Low | — | usmannasircyberpanel | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 14, 2026 |
|---|
| CVE-2026-8732WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action | Evidence Aug 8, 2026Published May 29, 2026 | 9.8HighCritical | 1.9%Low | — | flippercodeWP Maps Pro | 61 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2026-8713Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value | Evidence Aug 8, 2026Published Jun 19, 2026 | 9.1HighCritical | 2.7%Low | — | themefusionAvada (Fusion) Builder | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2026-8679AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter | Evidence —Published May 22, 2026 | 7.5HighHigh | 1.9%Low | — | cssigniterteamAudioIgniter Music Player | 11 Repository evidenceEvidence observed: Sep 26, 2026 | May 22, 2026 |
|---|
| CVE-2026-86242Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds | Evidence —Published Sep 6, 2026 | 8.1HighHigh | 3.6%Low | — | maximhqBifrost | 11 Repository evidenceEvidence observed: Oct 5, 2026 | Sep 8, 2026 |
|---|
| CVE-2026-86218pre-authentication remote code execution | Evidence Sep 7, 2026Published Sep 6, 2026 | 10.0HighCritical | 14.5%Moderate | KEV | N-ableN-central | 52 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 8, 2026 |
|---|
| CVE-2026-86207Authentication bypass leads to unauthorised access to N-central | Evidence —Published Sep 5, 2026 | 7.7HighHigh | 1.3%Low | — | N-ableN-central | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 8, 2026 |
|---|
| CVE-2026-86206Access control filter bypass allows unauthorised access to APIs | Evidence —Published Sep 5, 2026 | 6.9ModerateMedium | 1.1%Low | — | N-ableN-central | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 8, 2026 |
|---|
| CVE-2026-85688TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer | Evidence —Published Sep 4, 2026 | 9.3HighCritical | 2.6%Low | — | TEN-frameworkten-framework | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 14, 2026 |
|---|
| CVE-2026-85200GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion | Evidence —Published Sep 12, 2026 | 7.5HighHigh | 3.2%Low | — | ninjewGEO my WP | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 14, 2026 |
|---|
| CVE-2026-84434Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field | Evidence Sep 20, 2026Published Sep 19, 2026 | 9.8HighCritical | 3.9%Low | — | Gravity FormsGravity Forms | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 20, 2026 |
|---|
| CVE-2026-8386WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID | Evidence —Published Jun 15, 2026 | 5.3ModerateMedium | 0.8%Low | — | UnknownWP Go Maps | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jun 15, 2026 |
|---|
| CVE-2026-8385WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback | Evidence —Published Jun 15, 2026 | 5.3ModerateMedium | 0.7%Low | — | UnknownWP Go Maps | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jun 15, 2026 |
|---|
| CVE-2026-8383LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API | Evidence —Published Jun 17, 2026 | 5.3ModerateMedium | 0.7%Low | — | UnknownLearnPress | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jun 17, 2026 |
|---|
| CVE-2026-82456argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP | Evidence —Published Aug 29, 2026 | 10.0HighCritical | 1.7%Low | — | argoproj-labsargocd-mcp | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 24, 2026 |
|---|
| CVE-2026-8237Concrete CMS 9.5.0 and below is vulnerable to IDOR in the/ccm/frontend/conversations/message_detail endpoint | Evidence Aug 8, 2026Published May 21, 2026 | 6.3ModerateMedium | 0.7%Low | — | Concrete CMSConcrete CMS | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2026-8236Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID} | Evidence —Published May 21, 2026 | 6.3ModerateMedium | 0.9%Low | — | Concrete CMSConcrete CMS | 11 Repository evidenceEvidence observed: Sep 26, 2026 | May 22, 2026 |
|---|
| CVE-2026-82329Potential authentication bypass leading to administrative access in Artifactory | Evidence Sep 1, 2026Published Aug 28, 2026 | 9.8HighCritical | 14.1%Moderate | KEV | jfrogartifactory | 91 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2026-82222WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability | Evidence Aug 30, 2026Published Aug 28, 2026 | 10.0HighCritical | 2.3%Low | — | Liquid Web / StellarWPGiveWP | 61 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 30, 2026 |
|---|
| CVE-2026-8181Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover | Evidence Aug 8, 2026Published May 14, 2026 | 9.8HighCritical | 3.0%Low | — | burstbvBurst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) | 131 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 8, 2026 |
|---|
| CVE-2026-81199MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route | Evidence —Published Sep 2, 2026 | 5.3ModerateMedium | 0.5%Low | — | UnknownMasterStudy LMS WordPress Plugin | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2026-80099Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret | Evidence Sep 12, 2026Published Sep 9, 2026 | 8.8HighHigh | 2.9%Low | — | NewfoldWP Plugin Web, WP Plugin Crazy Domains, WP Module Data, WP Plugin Hostgator, WP Plugin Bluehost | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 12, 2026 |
|---|
| CVE-2026-7798FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter | Evidence —Published May 22, 2026 | 5.4ModerateMedium | 0.8%Low | — | techjewelFluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | 11 Repository evidenceEvidence observed: Sep 26, 2026 | May 22, 2026 |
|---|
| CVE-2026-77806SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code... | Evidence Aug 25, 2026Published Aug 21, 2026 | 9.8HighCritical | 4.5%Low | — | SPIPSPIP | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 25, 2026 |
|---|
| CVE-2026-76904GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers | Evidence Aug 25, 2026Published Aug 21, 2026 | 9.8HighCritical | 4.0%Low | — | geotoolsgeotools | 31 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 25, 2026 |
|---|
| CVE-2023-25157Unfiltered SQL Injection Vulnerabilities in Geoserver | Evidence Aug 8, 2026Published Feb 21, 2023 | 9.8HighCritical | 85.2%High | — | geoservergeoserver | 133 Repository evidenceEvidence observed: Sep 25, 2026 | Aug 8, 2026 |
|---|
| CVE-2026-7467Read More & Accordion <= 3.5.7 - Privilege Escalation via importData | Evidence —Published May 20, 2026 | 8.8HighHigh | 1.6%Low | — | edmonparkerRead More & Accordion | 11 Repository evidenceEvidence observed: Sep 26, 2026 | May 20, 2026 |
|---|
| CVE-2026-73034DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header | Evidence Aug 13, 2026Published Aug 11, 2026 | 9.3HighCritical | 5.7%Low | — | eosphoros-aiDB-GPT | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 13, 2026 |
|---|
| CVE-2026-72898Metabase SQL injection via password reset endpoint | Evidence Aug 11, 2026Published Aug 10, 2026 | 10.0HighCritical | 19.0%Moderate | KEV | MetabaseMetabase | 81 Repository evidenceEvidence observed: Sep 26, 2026 | Sep 2, 2026 |
|---|
| CVE-2026-71209audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal | Evidence —Published Aug 5, 2026 | 7.5HighHigh | 1.9%Low | — | advplyraudiobookshelf | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 10, 2026 |
|---|
| CVE-2026-69251Flowise RCE via TypeORM DataSource | Evidence Aug 29, 2026Published Aug 4, 2026 | 9.0HighCritical | 2.7%Low | — | FlowiseAIFlowise, flowise-components | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 29, 2026 |
|---|
| CVE-2026-69085SiYuan before v3.7.3 SQL Injection via searchDocs | Evidence Aug 10, 2026Published Aug 3, 2026 | 9.9HighCritical | 1.5%Low | — | siyuan-notesiyuan | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 10, 2026 |
|---|
| CVE-2026-69084SiYuan before v3.7.3 SQL Injection via searchEmbedBlock | Evidence Aug 10, 2026Published Aug 3, 2026 | 9.9HighCritical | 1.6%Low | — | siyuan-notesiyuan | 21 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 10, 2026 |
|---|
| CVE-2026-6875Sandbox Escape in ServiceNow AI Platform | Evidence Aug 12, 2026Published Jul 13, 2026 | 9.5HighCritical | 1.4%Low | — | ServiceNowServiceNow AI Platform | 31 Repository evidenceEvidence observed: Sep 26, 2026 | Aug 12, 2026 |
|---|
| CVE-2026-6854My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters | Evidence —Published Jul 8, 2026 | 7.5HighHigh | 1.6%Low | — | joedolsonMy Calendar – Accessible Event Manager | 11 Repository evidenceEvidence observed: Sep 26, 2026 | Jul 8, 2026 |
|---|