Vulnerabilidades exploráveis hoje
410,305na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,769
Novos KEV · 24H0
Exploit Today ≥ 701,700
Distribuição · última janela
- Crítica5,510
- Alta20,947
- Média20,093
- Baixa2,065
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1217607.5 ALT—
———Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.5hCVE-2024-23425——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2024-23426——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2024-23427——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2026-1245054.3 MÉD—
———A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.14hCVE-2024-23428——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2026-1245046.3 MÉD—
———A vulnerability was detected in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file ReportService.java. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 2.4.0 can resolve this issue. The patch is named 8d2eaffc79b977c9d11222b9d435a002dceaa062. It is suggested to upgrade the affected component.14hCVE-2026-1245024.3 MÉD—
———A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.15hCVE-2026-1245017.3 ALT—
———A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.15hCVE-2026-1245006.3 MÉD—
———A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component File Handler. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.15hCVE-2026-1244994.7 MÉD—
———A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affects the function write_translations of the file application/controllers/ToolController.class.php of the component Translation Tool. The manipulation of the argument lang leads to code injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.15hCVE-2024-23429——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2026-944348.8 ALT—
———Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.
This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.2hCVE-2024-23430——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2026-1217636.5 MÉD—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Hummingbird hummingbird-performance allows Stored XSS.This issue affects Hummingbird: from n/a through 3.21.2.5hCVE-2026-1216116.5 MÉD—
———A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set. A remote attacker could exploit this by providing a crafted H.265 media file or stream that, when processed by an application using GStreamer, causes unpredictable parser behavior and may crash the application. This can lead to a denial of service for any application using GStreamer to play back H.265 content.2hCVE-2026-123753——
———Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.4hCVE-2026-1217647.1 ALT—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.5hCVE-2026-123766——
———Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.4hCVE-2026-1217807.1 ALT—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese Flying Images nazy-load allows Stored XSS.This issue affects Flying Images: from n/a through 2.4.15.5hCVE-2026-123770——
———Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not apply, and multipart temporary files were not deleted. An unauthenticated caller could exhaust memory or disk. Version 2.0.2 bounds these bodies with configurable limits and deletes temporary files. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.4hCVE-2024-23431——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2024-23432——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2024-23433——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2024-23434——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2024-23435——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2026-1234637.1 ALT—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through 2.4.0.5hCVE-2024-23436——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2026-1234657.5 ALT—
———Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2.5hCVE-2026-123779——
———Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone HTTP server, the OpenAPI, Swagger UI and MCP catalog endpoints, the services listing, WS-MetadataExchange GetMetadata and the ping module still disclosed its metadata to anonymous callers, including operation names and request and response schemas. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.4hCVE-2026-1234847.1 ALT—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.5hCVE-2026-1245907.3 ALT—
———A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of the argument userName/userPwd/userEmail/userId leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.4hCVE-2026-1246256.3 MÉD—
———A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selected_ids/ItemID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.1hCVE-2024-23437——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2026-1245915.5 MÉD—
———A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.4hCVE-2026-1245867.3 ALT—
———A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.5hCVE-2024-23438——
———Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2hCVE-2026-1245874.3 MÉD—
———A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue.5hCVE-2026-81422——
———The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be automatically logged in, even when user registration is disabled on the site.8hCVE-2026-1095824.0 MÉD—
———Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. Sensitive information used by the product may be obtained.7h