Vulnerabilities exploitable today
366,194in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,682
New KEV · 24H0
Exploit Today ≥ 701,626
Distribution · last window
- Critical2,415
- High10,330
- Medium5,246
- Low512
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-815605.3 MED—
———A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.13hCVE-2026-815625.3 MED—
———A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.10.3 is able to mitigate this issue. The patch is named a86d9e55694c98a122943eeff859461d0b9aa6d6. It is suggested to upgrade the affected component.9hCVE-2026-816586.5 MED—
———A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.9hCVE-2026-81659——
———Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export.9hCVE-2026-81662——
———Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/config_module.py.
The vulnerable code used requester-controlled keys in both the regular expression and the generated assignment:
f'{key} = {py_val}'
and appended an assignment if the key was not already present. The modified Python configuration module was subsequently reloaded using importlib.reload(). This creates a code-generation boundary in which specially crafted configuration keys can alter the Python source structure and result in execution of attacker-controlled Python statements.
Version impacted >=3.3.09hCVE-2026-816685.4 MED—
———A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in another organization by supplying that filter's identifier. This can result in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configuration.9hCVE-2026-81672——
———SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework’s error handler, which increases the severity due to the combination of information disclosure and SQL injection.9hCVE-2026-81673——
———The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of queries, causing database errors and potentially manipulating visit tracking records. Given the nature of the endpoint, this could also affect the integrity of analytics and the accuracy of records.9hCVE-2026-81674——
———The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries, which could facilitate further exploitation.9hCVE-2026-81675——
———The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries. The complexity of the query increases the potential impact, as it could allow for broader manipulation of the content retrieval logic.9hCVE-2026-81676——
———A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and potentially manipulate backend queries. The issue results in an error-based SQL injection and exposes internal database error messages and stack traces, revealing implementation details of the backend system.9hCVE-2026-81677——
———The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via PDOException. This confirms that user input is being incorporated directly into SQL statements without proper sanitization or the use of prepared statements.9hCVE-2026-81743——
———Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory.
Because the application constructs the log destination from this configurable value, an administrator could set LOG_FILE to an arbitrary filesystem path. Since attackers can influence logged content, this enables controlled data to be written into unintended files. The upstream commit specifically describes an exploitation chain in which an attacker injects a template into a chosen file and subsequently abuses application rendering behavior to execute code.
The patch removes LOG_FILE from the web-editable settings, introduces validate_log_file_name() to reject absolute paths, traversal, Windows paths, null bytes, and directory components, and centralizes log path construction through resolve_log_file_path().
Version impacted: >=3.3.09hCVE-2026-81753——
———Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafted Mermaid payload that results in JavaScript execution when another user views the affected case note.
The patch adds explicit Mermaid detection and HTML escaping around the token content before the generated Mermaid wrapper is returned. It also moves the wrapping logic earlier in page initialization so Markdown instances are protected consistently.
Version impacted >= 3.3.09hCVE-2026-81814——
———Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar.
The fix changes:
titleEl.innerHTML = arg.event.title
to:
titleEl.textContent = arg.event.title || ''
and similarly stops using innerHTML for the static download icon.
Version impacted =>3.3.09hCVE-2021-47997——
———Rejected reason: This CVE ID has been rejected.9hCVE-2021-47998——
———Rejected reason: This CVE ID has been rejected.9hCVE-2021-47999——
———Rejected reason: This CVE ID has been rejected.9hCVE-2021-48000——
———Rejected reason: This CVE ID has been rejected.9hCVE-2021-48001——
———Rejected reason: This CVE ID has been rejected.9hCVE-2021-48002——
———Rejected reason: This CVE ID has been rejected.9hCVE-2021-48003——
———Rejected reason: This CVE ID has been rejected.9hCVE-2021-48004——
———Rejected reason: This CVE ID has been rejected.9hCVE-2021-48005——
———Rejected reason: This CVE ID has been rejected.9hCVE-2022-51001——
———Rejected reason: This CVE ID has been rejected.9hCVE-2022-51002——
———Rejected reason: This CVE ID has been rejected.9hCVE-2022-51003——
———Rejected reason: This CVE ID has been rejected.9hCVE-2022-51004——
———Rejected reason: This CVE ID has been rejected.9hCVE-2022-51005——
———Rejected reason: This CVE ID has been rejected.9hCVE-2022-51006——
———Rejected reason: This CVE ID has been rejected.9hCVE-2022-51007——
———Rejected reason: This CVE ID has been rejected.9hCVE-2023-22431——
———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9hCVE-2023-22658——
———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9hCVE-2023-23905——
———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9hCVE-2023-24013——
———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9hCVE-2023-24017——
———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9hCVE-2023-24462——
———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9hCVE-2023-24541——
———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9hCVE-2023-24543——
———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9hCVE-2023-24596——
———Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused9h