Vulnerabilidades exploráveis hoje
17,566na visualização atual
Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.
No catálogo KEV1,769
Novos KEV · 24H0
Exploit Today ≥ 701,700
Distribuição · última janela
- Crítica5,509
- Alta20,920
- Média19,981
- Baixa2,058
Filtros
Janela
Severidade
Filtros
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1123597.5 ALT24.8%
——7Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86.16dCVE-2025-58403—43.1%
——13CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the attacker to steal session cookies and perform actions on behalf of the victim within the application.
The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.11dCVE-2025-30054—0.9%
——0CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root.
The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.11dCVE-2025-30053—29.1%
——9The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication.
The vulnerability was confirmed to affect versions up to 2026.MS3. Version 2026.MS3 with the updater-upkg component in version 5.3.0 or higher is not affected by this vulnerability.4dCVE-2025-30052—27.9%
——8The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system.
The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.11dCVE-2025-30051—0.8%
——0The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account.
This issue was fixed in version 2026.MS311dCVE-2025-30050—12.9%
——4CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges.
This issue was fixed in version 2026.MS311dCVE-2025-30049—11.1%
——3The CGM CLININET application stores user passwords as unsalted MD5 hashes.
This issue was fixed in versions 2026.MS1 and 2026.MS311dCVE-2025-30047—32.0%
——10CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server.
This issue was fixed in version 2026.MS311dCVE-2025-30046—18.3%
——5In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges.
The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.11dCVE-2025-30045—9.8%
——3CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges.
The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.11dCVE-2025-30043—10.9%
——3CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker in the adjacent network to retrieve the list of patient documents and download those documents.
This issue was fixed in version 2026.MS311dCVE-2026-93489—14.0%
——4Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.
Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.6dCVE-2026-75779—68.5%
——21Improper Neutralization of Special
Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request
Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in
administrator into visiting a phishing website, causing the router to execute
arbitrary commands with root privileges.
Refer to the '
Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.6dCVE-2026-75775—49.2%
——15Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.6dCVE-2026-632449.8 CRÍ51.2%
——15An authentication
bypass vulnerability in WizLearn Technologies' Learning Management System (LMS)
could allow an unauthenticated remote attacker to bypass password
authentication and the OAuth authentication flow by sending a specially crafted
POST request, potentially resulting in unauthorised access to user accounts and
full administrative control of the LMS platform.6dCVE-2026-4952—21.0%
——6The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it (self-XSS). However, the business reference is included in the order details when the user places an order through the web interface. The order is later listed in the OrderAdministration portal (AuftragsManager) of VertiGIS WebOrderSystem, where the stored code is executed as soon as a highly privileged user opens the order. Version 7.0.8.6 of WebOrderSystem, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.11dCVE-2026-4951—30.2%
——9The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups). The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL. JavaScript code placed in this parameter is executed in the victim's browser. An unauthenticated attacker who knows the URL structure can craft a link that contains script code. The code runs if a privileged user who is currently logged into the portal opens the link. Because administrative users can change the passwords of other users, including administrators, without entering the old password, an attacker may be able to take over accounts or lock out other users. Version 7.0.8.6, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.11dCVE-2026-4950—23.9%
——7The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups). User properties, for example the "secondName" parameter, can be filled with JavaScript code while editing a user. The code is stored and executed in the browser of any other privileged user who opens the edited user entry or the user overview of the corresponding user group. An authenticated attacker with access to the portal can use this to run script code in the session of other portal users. Version 7.0.8.6, the latest available at the time of testing, is affected. The vendor did not provide information about further affected versions.11dCVE-2026-632434.3 MÉD10.9%
——3An
authentication vulnerability in the Bluetooth Low Energy (BLE) implementation
of Creative Sound Blaster Katana could allow an attacker within Bluetooth range
to connect to an affected device without prior pairing or authentication.6dCVE-2026-559819.6 CRÍ5.1%
——2A firmware verification vulnerability in Creative Sound
Blaster Katana could allow an attacker to modify a legitimate firmware image
and upload the modified firmware to an affected device.6dCVE-2026-942688.1 ALT25.3%
——8The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of the update-user action in its front-end Forms module consistently between the stage that authorises the request and the stage that carries it out, which allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account and be issued a valid session for it. Exploitation requires the site to publish two separate front-end form configurations whose targets are mapped to visitor-submitted values.16dCVE-2026-942679.0 CRÍ33.8%
——10The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values.16dCVE-2026-942646.8 MÉD23.6%
——7The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator.
This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.16dCVE-2026-942628.1 ALT21.3%
——6The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requester is authorised to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only when the target account holds an administrator role, which allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires the site to publish a form whose user-update action maps its target to a visitor-submitted value rather than to the default current user.16dCVE-2026-1135013.1 BAI8.3%
——3The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.16dCVE-2026-1135007.5 ALT23.3%
——7The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.16dCVE-2026-1134997.5 ALT23.3%
——7The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.16dCVE-2026-1134725.4 MÉD14.4%
——4The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.16dCVE-2026-1122303.7 BAI10.7%
——3The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.16dCVE-2026-1122194.9 MÉD26.0%
——8The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and have the Download Monitor WordPress plugin before 5.3.5 serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors; single-site installations are unaffected.16dCVE-2026-1119827.2 ALT26.9%
——8The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.16dCVE-2026-1119666.8 MÉD23.6%
——7The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.16dCVE-2026-1117385.5 MÉD20.6%
——6The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is not a Super Admin to create or overwrite network-wide options.16dCVE-2026-1117373.5 BAI8.2%
——2The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).16dCVE-2026-1105373.8 BAI15.7%
——5The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.16dCVE-2026-1105103.5 BAI1.4%
——0The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could allow users with the author role and above to inject iframe and form elements into published pages.16dCVE-2026-1099367.5 ALT20.8%
——6The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.16dCVE-2026-1099355.3 MÉD20.8%
——6The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.15dCVE-2026-1099345.3 MÉD20.8%
——6The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.16d