PULSE
ES
FEED
ransomincransom reclama a bereskinparr.com smartbiggar.ca · CA · Professional Servicesransomsilentransomgroup reclama a K.r.a. ...s · Not Foundransomlamashtu reclama a Gräfliches Hofbrauhaus Freising · DE · Agriculture and Food Productionransomlamashtu reclama a VERGI Muenster · DE · Energy & Utilitiesransomn0n reclama a Heritage Senior Living · US · Healthcareransomlamashtu reclama a FuG-Gruppe · DE · Otherransomlamashtu reclama a MECA-PRECIS · FR · Manufacturingransomlamashtu reclama a WEPOS Chemie · DE · Manufacturingransomsilentransomgroup reclama a K.r.. ...s · Not Foundransombraincipher reclama a novagroupgbc.com · GB · Otherransombraincipher reclama a oflaherty-law.com · IE · Professional Servicesransombraincipher reclama a clinicaromero.com · AR · Healthcareransombraincipher reclama a sodali.com · US · Professional Servicesransombraincipher reclama a srsnodgrass.com · US · Professional Servicesransomincransom reclama a bereskinparr.com smartbiggar.ca · CA · Professional Servicesransomsilentransomgroup reclama a K.r.a. ...s · Not Foundransomlamashtu reclama a Gräfliches Hofbrauhaus Freising · DE · Agriculture and Food Productionransomlamashtu reclama a VERGI Muenster · DE · Energy & Utilitiesransomn0n reclama a Heritage Senior Living · US · Healthcareransomlamashtu reclama a FuG-Gruppe · DE · Otherransomlamashtu reclama a MECA-PRECIS · FR · Manufacturingransomlamashtu reclama a WEPOS Chemie · DE · Manufacturingransomsilentransomgroup reclama a K.r.. ...s · Not Foundransombraincipher reclama a novagroupgbc.com · GB · Otherransombraincipher reclama a oflaherty-law.com · IE · Professional Servicesransombraincipher reclama a clinicaromero.com · AR · Healthcareransombraincipher reclama a sodali.com · US · Professional Servicesransombraincipher reclama a srsnodgrass.com · US · Professional Services
CVE Watch401,106 in full archive

Vulnerabilities exploitable today

16,409in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,665

Distribution · last window

  • Critical
    3,438
  • High
    15,697
  • Medium
    14,715
  • Low
    1,446
Filters
Filters

Window

Severity

Flags

Vulnerabilities5,321–5,360 · 16,409
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1066209.6 CRI
25.3%
——8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.7dCVE-2026-1066199.0 CRI
49.5%
——15ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.7dCVE-2026-1066188.8 HIG
7.7%
——2ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.7dCVE-2026-1066178.8 HIG
3.7%
——1ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.6dCVE-2026-1066168.6 HIG
44.0%
——13ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.6dCVE-2026-1066158.8 HIG
3.7%
——1ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.6dCVE-2026-1066147.8 HIG
5.6%
——2ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.6dCVE-2026-1066138.8 HIG
57.8%
——17ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.6dCVE-2026-1066129.9 CRI
37.2%
——11ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.6dCVE-2026-1060908.8 HIG
3.7%
——1ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.5dCVE-2026-1060898.8 HIG
9.1%
——3ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.5dCVE-2026-1059947.7 HIG
27.8%
——8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.5dCVE-2026-1059039.9 CRI
42.7%
——13ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.5dCVE-2026-1059018.8 HIG
3.7%
——1ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.5dCVE-2026-1059007.5 HIG
42.2%
——13ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.5dCVE-2026-10589910.0 CRI
45.2%
——14ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.2dCVE-2026-1058988.2 HIG
2.9%
——1ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.2dCVE-2026-1058978.6 HIG
39.9%
——12ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.5dCVE-2026-1058965.5 MED
3.7%
——1Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.6dCVE-2026-1054438.2 HIG
12.8%
——4IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.6dCVE-2026-1054427.5 HIG
32.2%
——10IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.8dCVE-2026-1045875.4 MED
9.9%
——3blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An attacker can craft a malicious bookmark URL containing HTML attribute-breaking payloads that execute arbitrary JavaScript in the victim's browser context when rendered in the local web interface.5dCVE-2026-1043487.8 HIG
9.2%
——3Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.6dCVE-2026-1043477.8 HIG
4.6%
——1Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.6dCVE-2026-1043467.8 HIG
4.6%
——1Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.6dCVE-2026-1038295.5 MED
2.9%
——1Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.7dCVE-2026-1038285.5 MED
2.9%
——1Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.7dCVE-2026-1038275.5 MED
4.0%
——1Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.7dCVE-2026-1038265.5 MED
2.9%
——1Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.7dCVE-2026-1038255.5 MED
4.1%
——1Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.7dCVE-2026-1038245.5 MED
2.9%
——1Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.7dCVE-2026-1038235.5 MED
4.0%
——1Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.7dCVE-2026-1038225.5 MED
4.1%
——1Substance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.7dCVE-2026-1038217.8 HIG
3.6%
——1Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.7dCVE-2026-1012948.7 HIG
11.0%
——3IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.8dCVE-2026-1001315.5 MED
4.1%
——1Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.8dCVE-2026-1001305.5 MED
4.1%
——1Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.8dCVE-2026-1001297.8 HIG
3.8%
——1Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.8dCVE-2026-1001287.8 HIG
3.8%
——1Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.8dCVE-2026-1001277.8 HIG
3.8%
——1Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.8d