CVE Watch405,425 in full archive

Vulnerabilities exploitable today

405,425in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,762

New KEV · 24H0

Exploit Today ≥ 701,694

Distribution · last window

Critical
5,621
High
21,758
Medium
20,122
Low
2,115

Filters

Window

Severity

Flags

Vulnerabilities405,401–405,425 · 405,425

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-107045—

—

———Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.8h CVE-2026-620069.8 CRI

—

———Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.7h CVE-2026-1180797.2 HIG

—

———Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.9h CVE-2026-1193257.5 HIG

—

———Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site.4h CVE-2026-1180808.8 HIG

—

———Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.7h CVE-2026-1180818.8 HIG

—

———Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.5h CVE-2026-133038.7 HIG

—

———HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.4h CVE-2026-620059.8 CRI

—

———Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.9h CVE-2026-61576—

—

———Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src/controllers/projectController.ts`, `testWebhook()` accepts `accountId` and `runId` from a `job.run.completed` request and passes them to `createPreviewWithExplores()` in `packages/backend/src/services/ProjectService/ProjectService.ts`. These unsanitized values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the `Authorization` header. Path traversal through `accountId` changes the requested path on `cloud.getdbt.com` without changing its host, so the credential-bearing request reaches an attacker-influenced path on that fixed host. The advisory claims API-key theft, but the supplied evidence does not establish that the attacker can observe the `Authorization` header. The unauthenticated webhook also allows preview creation. The target must be a `dbt Cloud IDE` project and the attacker must know its `projectUuid`; the UUID is not enumerable but can be discovered in shared or multi-tenant contexts. Version 0.3214.0 fixes identifier path traversal and verifies webhook HMAC signatures only when a secret is configured; without a secret, unsigned webhooks continue to be processed.4h CVE-2026-620049.8 CRI

—

———Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.9h CVE-2026-1180837.5 HIG

—

———Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.9h CVE-2026-1180846.5 MED

—

———Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.9h CVE-2026-620039.8 CRI

—

———Unauthenticated PHP Object Injection in Mission <= 1.22 versions.9h CVE-2026-115943—

—

———Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it. An attacker who supplies an XLSX file can run arbitrary Perl code.3h CVE-2026-620029.8 CRI

—

———Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.5h CVE-2026-620019.8 CRI

—

———Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.7h CVE-2026-1036657.8 HIG

—

———The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may be loaded, resulting in arbitrary code execution with administrative privileges.9h CVE-2026-619989.8 CRI

—

———Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.9h CVE-2026-1098226.5 MED

—

———Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker.9h CVE-2026-1180857.1 HIG

—

———Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.9h CVE-2026-1191186.5 MED

—

———Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read cookies and headers sent, while hard-coded --no-sandbox also overrides CRAWL4AI_CHROMIUM_SANDBOX.4h CVE-2026-1191197.5 HIG

—

———Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.9h CVE-2026-1191207.5 HIG

—

———Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.9h CVE-2026-107046—

—

———A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL.8h CVE-2026-107048—

—

———An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.8h