CVE Watch405,327 in full archive

Vulnerabilities exploitable today

405,327in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,762

New KEV · 24H0

Exploit Today ≥ 701,694

Distribution · last window

Critical
5,606
High
21,687
Medium
20,067
Low
2,082

Filters

Window

Severity

Flags

Vulnerabilities405,041–405,080 · 405,327

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-620109.8 CRI

—

———Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.6h CVE-2026-962038.8 HIG

—

———Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.6h CVE-2023-7357—

—

———A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 (11.19.4.0) release.5h CVE-2026-620099.8 CRI

—

———Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.6h CVE-2025-125236.5 MED

—

———Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user5h CVE-2026-1180787.2 HIG

—

———Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.6h CVE-2026-1190508.1 HIG

—

———Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files.8h CVE-2026-427074.3 MED

—

———Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.7h CVE-2026-107043—

—

———Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.5h CVE-2026-107044—

—

———Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.5h CVE-2026-107045—

—

———Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.5h CVE-2026-1092164.9 MED

—

———The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[<attacker-chosen key>]' parameter in all versions up to, and including, 5.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitability depends on a consuming plugin or theme built on Meta Box that exposes the background field to lower-privileged users and renders stored values via the rwmb_the_value()/format_single_value() pattern; the effective minimum privilege is whatever role that consumer permits, demonstrated at Subscriber level.7h CVE-2026-107046—

—

———A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL.5h CVE-2026-620089.8 CRI

—

———Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.6h CVE-2026-107047—

—

———Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.5h CVE-2026-107048—

—

———An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.5h CVE-2026-620069.8 CRI

—

———Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.6h CVE-2026-620059.8 CRI

—

———Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.6h CVE-2026-397356.5 MED

—

———Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.7h CVE-2026-107049—

—

———An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string.5h CVE-2026-1180777.2 HIG

—

———Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.6h CVE-2026-107050—

—

———An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution.5h CVE-2026-620049.8 CRI

—

———Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.6h CVE-2026-620039.8 CRI

—

———Unauthenticated PHP Object Injection in Mission <= 1.22 versions.6h CVE-2026-107051—

—

———Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.5h CVE-2026-107052—

—

———Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.5h CVE-2026-107053—

—

———Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox.5h CVE-2026-620029.8 CRI

—

———Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.6h CVE-2026-1180768.8 HIG

—

———Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.6h CVE-2026-107055—

—

———Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.5h CVE-2026-1180758.8 HIG

—

———Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.6h CVE-2026-107056—

—

———Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message.5h CVE-2026-107057—

—

———An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.5h CVE-2026-107058—

—

———An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.5h CVE-2026-1180747.2 HIG

—

———Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.6h CVE-2026-79589—

—

———The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure of the UART debugging interface having a lack of authentication, authorization and access control functionality. Once the interface is soldered and connected to the attacker, they gain root privilege to the system.6h CVE-2026-1030928.5 HIG

—

———IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.6h CVE-2026-620019.8 CRI

—

———Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.6h CVE-2026-1180738.8 HIG

—

———Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.6h CVE-2026-1168465.3 MED

—

———Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26.5h